STATE OF LOUISIANAState Government

2025-002 – Control Weakness and Noncompliance Related to Cost Allocation Process State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 2401LATANF, 2501LATANF, SNAP - Letter of Credit Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: Yes (Prior Year Finding Nos. 2024-003, 2023-003) See Schedule of Findings and Questioned Costs for chart/table. Condition: The Department of Children and Family Services (DCFS) did not have adequate controls in place to ensure the correct allocation of expenditures in accordance with the Cost Allocation Plan (CAP), which assigns costs to federal programs. In a nonstatistical sample of 60 cost allocation forms out of a population of 1,019 forms, five (8%) forms either did not agree to supporting documentation, used the incorrect grant number, or used a federal program that was not included in the CAP, which resulted in the incorrect allocation of costs to various cost pools affecting multiple federal programs. These errors resulted in overbilling the Temporary Assistance for Needy Families program (TANF) by $19 and the State Administrative Matching Grants for the Supplemental Nutrition Assistance Program (SNAP) by $625. The amounts overbilled represent questioned costs. In addition, the following programs were underbilled: TANF by $312, Child Support Services by $937, and SNAP by $19. Criteria: 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish, document, and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Per 2 CFR 200.400(d), the accounting practices of the non-federal entity must be consistent with cost principles and support the accumulation of costs, as required, and must provide for adequate documentation to support costs charged to the federal award. Cause: These errors occurred because there was not an effective review process in place to identify amounts being charged incorrectly through the cost allocation process. Effect: Failure to adequately review cost allocation supporting documentation increases the risk that unallowable costs could be charged to federal programs. This is the third consecutive year we have reported to DCFS management exceptions with internal controls related to the cost allocation process. Recommendation: Management should strengthen internal controls over the cost allocation review process. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-6).

2025-003 – Noncompliance and Weakness in Controls with Special Tests and Provisions Requirements State Entity: Louisiana State University Health Sciences Center – Shreveport (LSUHSC-S) Award Years: 2021–2024 Award Numbers: 80NSSC21K0273, 80NSSC22M0030, P20GM121307, R00HL145131, R01CA240496, R01CA271714, R01NS126273, R33AT010637, R56AI159672 Compliance Requirement: Special Tests and Provisions Pass-Through Entities: University of Massachusetts Chan Medical School, Washington University Repeat Finding: Yes (Prior Year Finding Nos. 2024-004, 2023-029, 2022-034, 2021-069, 2020-061, 2019-036) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the seventh consecutive year, Louisiana State University Health Sciences Center in Shreveport (LSUHSC-S) did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. We reviewed a nonstatistical sample of 16 federal Research and Development (R&D) Cluster awards from a population of 83 awards, plus two additional awards based on materiality, for the fiscal year ending June 30, 2025. We noted that for two of 18 awards (11%), LSUHSC-S did not have adequate documentation to show that the key personnel maintained the required level of effort, and there was also no evidence of prior approval from the federal grantor for a disengagement or change in key personnel, as required. In addition, we noted that during the period July 1, 2024, through December 31, 2024, LSUHSC-S’s controls were not effectively designed to ensure prior approval was obtained for changes in effort by key personnel, as required by federal regulations, specifically relating to disengagement from a project for more than three months or a 25% reduction in effort. Beginning with the quarter ending March 31, 2025, LSUHSC-S implemented quarterly time and effort monitoring. We tested the quarterly time and effort monitoring control for the period January 1, 2025, through June 30, 2025, and noted that, for eight of 18 awards (44%), LSUHSC-S did not complete the quarterly monitoring forms timely. Criteria: 2 CFR 200.308(f) states that a recipient or subrecipient must request prior written approval from the federal agency or pass-through entity for the following program and budget-related reasons: • Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). • Change in key personnel (including employees and contractors) that are identified by name or position in the federal award. • The disengagement from a project for more than three months, or a 25% reduction in time and effort devoted to the federal award over the course of the period of performance, by the approved project director or principal investigator. Cause: From July 1, 2024, through December 31, 2024, LSUHSC-S’s biannual time and effort certification was not effectively designed to ensure prior approval was obtained for changes in effort by key personnel, as required by federal regulations, specifically relating to disengagement from a project for more than three months or a 25% reduction in effort. As noted above, LSUHSC-S implemented quarterly time and effort monitoring in the third quarter of fiscal year 2025; however, this process was not fully implemented. Effect: Failure to implement controls over key personnel requirements increases the risk that federal programs are not performed as authorized and could result in noncompliance with Special Tests and Provisions requirements. Recommendation: Management should monitor changes in effort for key personnel and verify that prior written approval is obtained from the federal grantor for changes that exceed the thresholds set in federal regulations. Management should also ensure the time and effort monitoring forms are completed timely to ensure compliance with Special Tests and Provisions requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-45).

2025-004 – Control Weakness and Noncompliance with Special Tests and Provisions Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2019, 2023, 2024 Award Numbers: 15PJDP22GG03096COIP, 20237043838714, 2327452, DEEE0009716, M19AC00015, M23AC00008, NYLTS0022-21, R01AI172539, R01AI179317, R01DK131476, U54AG063546 Compliance Requirement: Special Tests and Provisions Pass-Through Entities: Brown University (via Trustees of Indiana University), Second Harvest Food Bank of Greater New Orleans and Acadiana, Texas Biomedical Research Institute, The Research Foundation for the State University of New York, University of Pittsburgh of the Commonwealth System of Higher Education Repeat Finding: Yes (Prior Year Finding Nos. 2024-006, 2023-007, 2022-006, 2021-009) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fifth consecutive year, the University of Louisiana at Lafayette (UL Lafayette) did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. We reviewed a nonstatistical sample of 22 federal R&D Cluster awards from a population of 212 awards for the fiscal year ending June 30, 2025. We noted that for nine (41%) of 22 federal R&D awards, key personnel were not involved in the project at the level required by the federal award or proposal submissions, and UL Lafayette did not obtain prior approval for such changes in effort from the federal grantor agency or pass-through entity. In addition, we noted that for two (9%) of 22 federal awards, UL Lafayette did not have time and effort certifications for key personnel and could not verify that the required effort was met. Criteria: 2 CFR 200.308(f) states that a recipient or subrecipient must request prior written approval from the federal agency or pass-through entity for the following program and budget-related reasons: • Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). • Change in key personnel (including employees and contractors) that are identified by name or position in the federal award. • The disengagement from a project for more than three months, or a 25% reduction in time and effort devoted to the federal award over the course of the period of performance, by the approved project director or principal investigator. Cause: UL Lafayette did not have adequately-designed controls in place to monitor key personnel to ensure that the required level of effort was met and to ensure prior written approvals were obtained when needed. UL Lafayette implemented effort certifications in Banner with reporting cycles covering January 1, 2024, through December 31, 2024, and January 1, 2025, through June 30, 2025. Annual and semiannual certifications are not sufficient to timely detect changes in key personnel effort and to ensure prior approvals are obtained when applicable. Additionally, UL Lafayette represented that principal investigators (PIs) are responsible for their required level of effort and should communicate any significant changes in level of effort to UL Lafayette’s Office of Research and Sponsored Programs; however, there is no mechanism to ensure that PIs are timely fulfilling their responsibilities to communicate such changes. Effect: Failure to implement adequately designed controls over key personnel requirements increases the risk that federal programs are not performed as authorized and could result in noncompliance with Special Tests and Provisions requirements. Recommendation: Management should develop controls to ensure the required key personnel level of effort is met and to anticipate the need to seek prior approval for key personnel reductions in effort or disengagement from the project when required. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-50).

2025-005 – Noncompliance with Subrecipient Monitoring Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2019, 2022, 2024 Award Numbers: 1920858, 2119688, 2418434, 80NSSC21M0333, 80NSSC24K0865, U19AI142636 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding Nos. 2024-008, 2023-008, 2022-007, 2021-010) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fifth consecutive year, UL Lafayette did not adequately monitor subrecipients of the R&D Cluster Programs. In a nonstatistical sample of seven subawards out of a population of 49 subawards, it was noted that for six (86%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipient’s fraud risk and risk of noncompliance with federal regulations and the terms of the subaward. For three (43%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the financial and performance reports required by the subaward agreements were obtained and reviewed by UL Lafayette. For two (29%) of the subrecipients evaluated, the subaward documents did not contain the federal award date, as required by federal regulations, and additionally in one (14%) of these two noted subawards, the subaward did not contain the period of performance. For one (14%) of the subrecipients reviewed, UL Lafayette was unable to provide documentation that ensured the subrecipient obtained the required audit and that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Criteria: Note: Auditor determined that all subawards selected for testing were issued prior to October 2024 and continued to apply the previous version of 2 CFR 200 (Compliance Supplement Part 3.1). 2 CFR 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. 2 CFR 200.332(d)(1) requires that pass-through entities monitor the activities of the subrecipient including reviewing financial and performance reports required by the pass-through entity. Per 2 CFR 200.332(a)(1)(iv) and 2 CFR 200.332(a)(1)(v), all pass-through entities must ensure that every subaward includes the federal award date and subaward period of performance start and end date. 2 CFR 200.332(f) requires pass-through entities to verify that every subrecipient is audited as required by 2 CFR 200 Subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501 of $750,000. Cause: UL Lafayette did not have sufficient controls in place to adequately monitor subrecipients, as required by federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls for subrecipient monitoring to ensure that risk assessments are performed and documented on all subrecipients, that all required financial and performance reports are obtained and reviewed, that required information is included in the subaward documents, and that all required subrecipient audit reports are obtained and reviewed in order to evaluate the impact of any findings noted by the audit and issue management decision letters, if applicable. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-53).

2025-006 – Inadequate Controls Related to Summer EBT Program for Children Reporting State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 202424N117546, 202525N117546 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Department of Children and Family Services (DCFS) did not ensure that controls were in place requiring a documented review of Summer Electronic Benefit Transfer (EBT) Program for Children monthly FNS-46 and FNS-388 reports prior to submission to United States Department of Agriculture - Food and Nutrition Service (FNS). For each of the 12 monthly reports for both FNS-46 and FNS-388 for fiscal year 2025, there was no evidence of review prior to submission to FNS. Criteria: 2 CFR 200.303(a) requires that recipients of federal awards establish, document, and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: DCFS did not have a policy in place to document approval of Summer EBT Program for Children federal reports prior to submission. DCFS represented that a staff member, other than the person who submitted the report, performed a review for accuracy prior to the report being submitted. However, management was unable to provide evidence of the review. Effect: Although no exceptions were noted in the reports reviewed, failure to establish controls that include a documented review over data submissions to FNS could result in inaccurate information being included in the Summer EBT Program for Children reports. Recommendation: DCFS should document and maintain internal controls requiring evidence that monthly FNS-46 and FNS-388 reports are reviewed prior to submitting the reports to the federal agency. Management’s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-10).

2025-007 – Inadequate Controls over Credit Cards and Bank Accounts State Entity: Road Home Corporation D/B/A Louisiana Land Trust (LLT) Award Years: 2006, 2008, 2013, 2016, 2018 Award Numbers: B-06-DG-22-0001, B-06-DG-22-0002, B-08-DG-22-0003, B-13-DS-22-0002, B-16-DL-22-0001, B-18-DP-22-0001 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Program Income Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Road Home Corporation d/b/a Louisiana Land Trust (LLT) does not have adequate controls in place to ensure that LLT credit card transactions and bank accounts are properly monitored and comply with its own policies and federal program regulations, increasing the risk of theft and fraud. In a review of credit card statements between April 2023 and July 2024, we noted the following: • In May 2023, there was a $110 charge to the credit card assigned to an employee whose employment ended with LLT in December 2016. • Between July 2023 and October 2023, $12,166 in charges were made to the credit card assigned to LLT’s Chief Financial Officer (CFO), of which $9,255 appeared to be non-business related. We found that the CFO concealed certain charges from the auditors and from the Office of Community Development-Disaster Recovery (OCD-DR), who LLT submits its reimbursement requests to. Other charges were marked as disputed; however, the CFO could not provide evidence of the dispute with the bank. After auditors informed LLT management of the apparent credit card misuse and requested LLTs original bank statements for fiscal year 2024, LLT management conducted a separate review of the statements between May 2021 and May 2025 and noted that the LLT CFO had concealed $162,210 in deposits and made unauthorized withdrawals totaling the same amount. The sources of the deposits included payments for mineral rights held by LLT, refunds from insurance and utility companies, and refunds of property taxes, all of which should have been recorded as revenues and/or a reduction of expenses and considered program income to the applicable grant program. LLT’s activities are exclusively supported by federal funds appropriated to the U.S. Department of Housing and Urban Development, from whom LLT receives grant funding for disaster recovery and sustainability programs through OCD-DR. The funds were associated with properties owned by LLT that had previously been acquired with federal grant funds. Criteria: Good internal control includes ensuring that accurate records are maintained to reconcile monthly credit card and bank statements. LLT’s credit card policy provides that credit cards may be used for Community Development Block Grant approved expenses and are not for personal use. LLT’s policy also requires the cardholder to reconcile purchases made during the monthly billing cycle by matching the purchases listed on the statement to actual receipts. The documentation must then be reviewed by the cardholder’s supervisor. LLT’s bank reconciliation policy provides that at the end of each month, the accounting specialist will be responsible for obtaining a month-end bank statement for each account used by LLT and reconciling it to the general ledger. Cause: Management is not ensuring its policies are followed. Effect: There is an increased risk of theft and fraud. Recommendation: Management should ensure established policies and procedures are followed, including segregation of duties, to ensure that LLT credit card transactions and bank accounts are properly monitored and comply with its own policies and program regulations. Management should pursue recoupment of misappropriated funds and continue to work with OCD-DR and the U.S. Department of Housing and Urban Development for the return of those funds to the federal grantor agency. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a corrective action plan (B-48).

2025-008 – Noncompliance and Control Weakness Over GEAR UP Scholarships State Entity: Student Tuition Assistance and Revenue Trust (START) Program Award Years: 2002–2015 Award Number: Unknown Compliance Requirement: Period of Performance Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Student Tuition Assistance and Revenue Trust (START) program currently maintains 3,266 START accounts totaling $2,668,155 that were originally created with scholarship funds awarded under the Gaining Early Awareness and Readiness for Undergraduate Programs (GEAR UP) federal program, with no mechanism to ensure compliance with federal regulations over the redistribution and/or return of these scholarship funds that have gone unused by the scholarship recipient (account beneficiary) within the prescribed number of years. Criteria: Per 34 CFR 694.16, funds held in reserve that are not used by an eligible student within six years of the student's scheduled completion of secondary school may be redistributed by the grantee to other eligible students; however, any scholarship funds that are not used by eligible students within six years of the students’ scheduled completion of secondary school and not redistributed by the grantee to other eligible students, must be returned to the federal grantor within 45 days after the six-year period for expending the scholarship funds expires. Cause: START currently has no written policies or procedures in place to monitor or track the account beneficiary’s completion of secondary school, when a beneficiary’s funds become eligible for redistribution to other eligible students, or when the unused funds are required to be returned to the federal grantor. START relies on the account beneficiary to inform START if they are not going to use the funds in the account before START personnel redistribute the funds to the remaining active accounts. Effect: Noncompliance with program requirements has resulted in questioned costs totaling $2,668,155 that may need to be returned to the federal grantor. Recommendation: START should develop written policies and procedures in accordance with federal regulations and provide additional training to staff over the monitoring of account beneficiary’s completion of secondary school and status after secondary school to ensure compliance with federal regulations for the redistribution and/or return of GEAR UP funds. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-49).

2025-009 – Inadequate Controls over and Noncompliance with Activities Allowed and Unallowed Requirements State Entity: Capital Area Human Services District (CAHSD) Award Year: Unknown Award Number: Unknown Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Capital Area Human Services District (CAHSD) did not have adequate controls in place to ensure that activities charged to the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) federal program were allowed per SAPT program regulations. A nonstatistical sample of 40 expenditures, from a population of 1,568 payroll and non-payroll transactions, identified that CAHSD inappropriately charged an employee’s salary to the SAPT program, resulting in $103,594 of questioned costs due to an unallowed activity. Criteria: 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish, document, and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. 45 CFR Part 96, Subpart L provides the appropriate uses of the SAPT program. Cause: CAHSD did not have adequate controls in place to review employees’ job functions to ensure compliance with the purpose of the SAPT program and allowability under grant requirements. Effect: Failure to adequately review expenditures for proper coding increases the risk that unallowable activities are charged to the SAPT program. Recommendation: Management should strengthen its internal controls over the expenditure review process to ensure all charges are allowed per the SAPT program regulations. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-2).

2025-010 – Inadequate Controls over and Noncompliance with Earmarking Requirements State Entity: Capital Area Human Services District (CAHSD) Award Year: Unknown Award Number: Unknown Compliance Requirement: Matching, Level of Effort, Earmarking Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: CAHSD did not have adequate controls in place to ensure that expenditures charged to the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) federal program met the earmarking requirements. CAHSD did not comply with the required threshold of expending at least 20% of funding for primary prevention programs, only expending 16.75% of CAHSD’s SAPT funds for primary prevention programs. Also, in a nonstatistical sample of 40 expenditure transactions out of 1,568, five (13%) transactions were not coded to the correct statistical internal order number within the LaGov accounting system. Criteria: 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish, document, and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. 45 CFR 96.124(b)(1) requires the state to expend not less than 20% for primary prevention programs for individuals who do not require treatment for substance abuse. CAHSD is required by the Louisiana Department of Health – Office of Behavioral Health to code these program expenditures to specific LaGov statistical internal order numbers to ensure the appropriate tracking of expenditures. Cause: The noncompliance occurred because of inadequate controls in place to review and track amounts expended on primary prevention programs. Effect: Failure to adequately review expenditure transactions for proper coding and track overall amounts expended for primary prevention programs increases the risk that earmarking compliance requirements will not be met. Recommendation: Management should strengthen internal controls over the review of expenditure transactions and develop internal controls over the tracking of primary prevention program expenditures through a periodic review of actual costs incurred to ensure the earmarking requirements are met. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-4).

2025-011 – Control Weakness over Temporary Assistance for Needy Families Requirements State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 2401LATANF, 2501LATANF Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: Department of Children and Family Services (DCFS) did not ensure that accurate and complete information was entered into the Louisiana Integrated Eligibility Project (LITE) system, which is used to determine if the applicant for TANF cash assistance is financially needy and determines the amount of eligible benefit. In a statistical sample of 40 out of 59,674 TANF - Family Independence Temporary Assistance Program and TANF - Kinship Care Subsidy Program cash assistance payments totaling $33,001,868, two (5%) recipient’s income calculation either did not include amounts from check stubs or did not include the Social Security income of all members of the household. Criteria: Per 45 CFR 260.20(a) one of the four purposes of the TANF program is to provide assistance to needy families so that children may be cared for in their own homes or in the homes of relatives. 45 CFR 263.2(b)(3) states that an “eligible family” must be financially eligible according to the appropriate income and resource (when applicable) standards established by the state and contained in its TANF plan. 2 CFR 200.303(a) requires that the recipient and subrecipient of federal awards establish, document, and maintain effective internal control that provides reasonable assurance of compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: DCFS employees did not ensure all information needed to validate the applicant’s eligibility and determine financial need was included in the LITE system prior to providing financial assistance. Effect: Although these exceptions did not result in incorrect payments, it increases the risk that applicants may receive benefits to which they are not entitled and could result in DCFS having to repay the funds to the federal grantor. Recommendation: DCFS management should strengthen controls to ensure accurate and complete information is entered into LITE to support that financially needy families receive the TANF cash assistance as allowed by federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-8).

2025-012 – Noncompliance and Control Weakness over Temporary Assistance for Needy Families Child Support Cooperation Requirements State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 2401LATANF, 2501LATANF Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: DCFS did not timely and appropriately sanction individuals receiving TANF cash assistance payments for child support due to non-cooperation related to establishing paternity, or related to establishing, modifying, or enforcing a support order. In a nonstatistical sample of 40 cases out of a population of 577 cases referred to TANF caseworkers by the DCFS Child Support Enforcement (CSE) Division for non-cooperation, nine (23%) cases were put on hold (sanctioned) between six and 72 days after the date required by DCFS policy. For six of the nine cases, the client’s TANF cash assistance benefits were not denied, as required by federal regulations, for at least one month after the case was referred to a TANF caseworker. For these six cases, $3,116 in benefits were issued, which we consider to be questioned costs. Criteria: Based on 45 CFR 264.30(b) and (c), if CSE determines that an individual is not cooperating with child support enforcement requirements, and the individual does not qualify for a good cause or other exception, then CSE must notify the TANF caseworkers. The TANF caseworkers must then take appropriate action by deducting from the assistance an amount equal to not less than 25% of the amount of such assistance; or deny the family any assistance under the program. Based on 45 CFR 264.31(a), if the TANF caseworkers did not enforce the penalties against recipients required under 45 CFR 264.30(c), the federal grantor could impose a penalty on the state of not less than 1% and not more than 5% of the adjusted State Family Assistance Grant, which is a portion of TANF. DCFS policy requires analysts, within 10 days of receiving documentation of failure to cooperate with CSE, to send cash assistance clients notice of noncooperation. This notice will inform the client that their case will be closed upon expiration of the 13-day notice period unless the client ends their failure to comply prior to that time. Cause: TANF caseworkers did not ensure that individuals who had been reported as noncompliant by CSE were sanctioned timely or denied TANF benefits, if appropriate. Effect: Noncompliance with CSE cooperation requirements could result in penalties assessed on the state by the federal grantor. Recommendation: Management should strengthen internal controls to ensure compliance with CSE requirements, including timely sanctions and denial of assistance, as appropriate. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-12).

2025-013 – Noncompliance and Control Weakness Related to Subrecipient Monitoring Requirements State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 2401LAFOST, 2401LATANF, 2501LAFOST, 2501LATANF Compliance Requirement: Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: DCFS did not have adequate controls in place to ensure compliance with subrecipient monitoring requirements related to the TANF and Foster Care Title IV-E (Foster Care) programs. In a statistical sample of 38 TANF subrecipient payments from a population of 482 TANF subrecipient payments totaling $67,022,221, 29 (76%) payments made under 11 subrecipient agreements did not identify award information including federal award number, name of federal agency, and assistance listing title and number, as required by federal regulations. In addition, two of the 11 agreements did not state how DCFS would monitor the subrecipients, although reviews of financial and performance reports as well as site visits were performed. In a statistical sample of 16 Foster Care subrecipient payments from a population of 171 Foster Care subrecipient payments totaling $22,349,520, seven (44%) payments were made under four contracts that did not identify award information including federal award number and assistance listing title and number, as required by federal regulations. In addition, for TANF and Foster Care subrecipients evaluated, DCFS could not provide formal documentation that the required risk analyses were performed to evaluate each subrecipient’s fraud risk and risk of noncompliance with federal regulations and the terms of the subaward. Criteria: Per 2 CFR 200.332(b)(1-3), a recipient must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information: (1) Federal Award Identification; (2) All requirements of the subaward, including requirements imposed by federal statutes, regulations, and the terms and conditions of the federal award; and (3) Any additional requirements that the pass-through entity imposes on the subrecipient for the recipient to meet its responsibilities under the federal award. 2 CFR 200.332(c) requires recipients to evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward for purposes of determining the appropriate subrecipient monitoring. Per 2 CFR 200.332(e), a recipient must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. In monitoring a subrecipient, a recipient must review financial and performance reports. Cause: In fiscal year 2025, DCFS made changes to certain subaward agreements. These changes removed certain language from the agreements, which caused them to be in noncompliance with federal requirements. In addition, DCFS failed to document required risk assessments. DCFS represented they performed evaluations over subrecipients through inquiry and observation, ensured good standing on the Louisiana Secretary of State’s website, and monitored audit reports for compliance. Effect: Failure to properly monitor and manage subrecipients, including documenting risk assessments, results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal grantor. Recommendation: DCFS should strengthen controls to ensure that all required information is included in the subaward documents and that risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-14).

2025-014 – Noncompliance and Control Weakness Related to the Temporary Assistance for Needy Families Work Verification Plan State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 2401LATANF, 2501LATANF Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: DCFS did not ensure that all work activity supporting documentation for cash assistance recipients was accurate and maintained for hours worked under the TANF program. In a nonstatistical sample of 60 out of 41,893 work activity records in the job-tracking system for approximately 2,300 clients per month, seven (12%) work-eligible participant’s hours either did not agree to supporting documentation, or supporting documentation of work activities was not maintained, as required by federal regulations. Criteria: Per 45 CFR 261.61(a), a state must support each individual’s hours of participation through documentation in accordance with its Work Verification Plan. 45 CFR 261.10(a)(1) states, in part, a parent or caretaker receiving assistance must engage in work activities when the state has determined that the individual is ready to engage in work. Per 45 CFR 261.65(a)(2) and 45 CFR 262.1(a)(15), if determined that the state has not maintained adequate documentation, verification, or internal control procedures to ensure the accuracy of the data used in calculating the work participation rates, the federal grantor could impose a penalty to the state of not less than 1% and not more than 5% of the adjusted State Family Assistance Grant. Cause: DCFS employees did not adhere to requirements in the state’s work verification plan pertaining to maintaining and verifying supporting documentation for the hours worked by participants. Effect: This is the fourteenth consecutive year we have reported to DCFS management exceptions with internal controls and compliance related to this TANF requirement. Noncompliance could result in penalties assessed to the state by the federal grantor. Recommendation: DCFS management should ensure DCFS employees comply with existing policies and procedures regarding the state’s work verification plan. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-16).

2025-015 – Noncompliance with and Control Weakness over Adoption Assistance Eligibility Requirements State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 2401LAADPT, 2501LAADPT Compliance Requirement: Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: DCFS did not maintain certain eligibility documentation or obtain signatures timely on certain adoption forms, as required by federal regulation and state policy. In a statistical sample of 60 out of 104,052 Adoption Assistance payments totaling $43,111,539, two (3%) cases tested did not have documentation of the fingerprint-based criminal records check or the State Central Registry check. In addition, two (3%) other cases tested did not have the adoption assistance agreement form signed on or before the day of the final decree of adoption. Criteria: To comply with 42 USC 671(a)(20), DCFS policy 1-1000, Criminal Record Clearance, requires DCFS personnel to complete the fingerprint-based, national criminal background clearances on adoptive parent applicants and adult household members. DCFS policy 9-400, Qualifications of the Foster and Adoptive Caregivers, requires adoptive caregivers to have an affirmative child abuse/neglect clearance and not be listed as a perpetrator of abuse or neglect on the State Central Registry. Also, per DCFS policy 8-740, Special Adoption Subsidy Situations, the adoption subsidy agreement must be completed and approved before the final decree (of adoption) is issued. 2 CFR 200.303(a) requires that recipients of federal awards establish, document, and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: DCFS did not have a policy over retention of documentation associated with criminal records checks, as well as State Central Registry checks. In addition, DCFS employees did not follow DCFS policy to ensure adoption assistance agreements were signed within the required timeframe. Effect: Failure to implement proper controls over adoption assistance eligibility documentation resulted in noncompliance with federal regulations and state policies. Noncompliance with the criminal records check and State Central Registry check resulted in $921 in questioned costs. Recommendation: DCFS should strengthen internal controls to ensure adoption assistance eligibility documentation is maintained. These internal controls should also ensure adoption assistance agreements are signed and in effect before the final decree of adoption. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-18).

2025-016 – Noncompliance with and Control Weaknesses over Foster Care Requirements State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 2401LAFOST, 2501LAFOST Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, and Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: DCFS did not have adequate controls in place to ensure the allowability of payments or the eligibility of recipients for the Foster Care program. In a statistical sample of 60 out of 36,291 Foster Care payments totaling $19,228,858, we noted the following: • 20 (33%) cases, some of which had multiple exceptions, did not have proper authorizations related to housing eligibility requirements. 12 of the 20 cases did not have documentation of the fingerprint-based criminal records check or the State Central Registry check. 14 of the 20 cases did not have documentation supporting that the foster home, childcare institution, or child placing agency was certified/licensed during the service period tested. For 2 of the 20 cases, support for placement in a qualified residential treatment program was not provided. • 8 (13%) cases, some of which are noted above, had conflicting, unsupported, or inaccurate information on the eligibility determination forms. • For 5 (8%) cases, some of which are noted above, payment authorization forms were not approved by a supervisor prior to the payment. • For 1 (2%) case noted above, the support for financial need used to determine eligibility was not provided. • For 1 (2%) case noted above, there was no support for the special rate paid to the recipient. • For 1 (2%) case noted above, there was an overpayment of three days due to using an incorrect service start date. Criteria: To comply with 42 USC 671(a)(20), DCFS policy 1-1000, Criminal Record Clearance, requires DCFS personnel to complete the fingerprint-based, national criminal background clearances on adoptive parent applicants and adult household members. DCFS policy 9-400, Qualifications of the Foster and Adoptive Caregivers, requires adoptive caregivers to have an affirmative child abuse/neglect clearance and not be listed as a perpetrator of abuse or neglect on the State Central Registry. Also, DCFS policy, Section F - Eligibility Criteria IV-E, requires foster family homes to be certified and facilities to be licensed. 2 CFR 200.303(a) requires that recipients of federal awards establish, document, and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: DCFS did not have a policy over retention of documentation associated with criminal records checks, as well as State Central Registry checks. In addition, DCFS employees did not follow DCFS policy to ensure payments were allowable, recipients were eligible, and proper rates were paid for services. Effect: Failure to implement proper controls over required documentation resulted in noncompliance with federal regulations and state policies. This noncompliance resulted in $66,597 in questioned costs. Recommendation: DCFS should strengthen internal controls to ensure Foster Care payments are allowable and recipients are eligible. In addition, rates paid to recipients should be supported and federal regulations and state policies should be followed. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-20).

2025-017 – Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act State Entity: Department of Children and Family Services (DCFS) Award Years: 2024, 2025 Award Numbers: 2401LAFOST, 2401LATANF, 2501LAFOST, 2501LATANF Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: DCFS did not comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements during fiscal year 2025 for the following federal programs: • For the Foster Care program, DCFS did not enter subaward information into the FFATA Subaward Reporting System (FSRS) or the System for Award Management (SAM), as applicable, for any of the 17 different subrecipients. DCFS disbursed approximately $22.3 million in expenditures to those subrecipients during fiscal year 2025. • For the TANF program, DCFS did not enter subaward information into FSRS or SAM, as applicable, for any of the 59 different subrecipients. DCFS disbursed approximately $66.6 million in expenditures to those subrecipients during fiscal year 2025. Criteria: 2 CFR Part 170, Appendix A(I)(a) and (b) requires the recipient to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to an entity into FSRS or SAM, as applicable, no later than the end of the month following the month in which the obligation was made. Cause: Management represented that the cause for this noncompliance is due to procedural changes that were being reviewed before the changes were implemented. Effect: This is the fourth consecutive year we have reported to DCFS management exceptions with compliance related to FFATA reporting. Not reporting obligating actions to FSRS or SAM, as applicable, prevents the public from having access to accurate information on how DCFS is obligating federal funds. Recommendation: DCFS should strengthen internal controls to ensure that appropriate personnel are timely and accurately entering the required award information for FFATA reporting in accordance with federal requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-22).

2025-018 – Inadequate Controls over Billing for Behavioral Health Services State Entity: Louisiana Department of Health (LDH) Award Years: 2024, 2025 Award Numbers: 2405LA5021, 2405LA5MAP, 2505LA5021, 2505LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding Nos. 2024-023, 2023-021, 2022-025, 2021-055, 2020-046, 2019-022) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the seventh consecutive year, the Louisiana Department of Health (LDH), the managed care organizations (MCOs), and Magellan Health Services (Magellan) did not have adequate controls in place to ensure that behavioral health services in the Grants to States for Medicaid program (Medicaid) and Children’s Health Insurance Program (CHIP) were properly billed and that improper encounters were denied. For fiscal year 2025, we identified approximately $15.8 million in encounters for services between July 1, 2024, and June 30, 2025, that were paid by the MCOs and Magellan even though the encounters do not appear to comply with LDH’s encounter coding requirements and/or approved fee schedules. Our analysis identified the following instances of billing errors: Providers were paid $10,851,041 for 155,873 encounters that were billed using incorrect procedure and modifier codes. Providers were paid $4,937,407 for 50,574 encounters that exceeded LDH’s specialized behavioral health services fee schedules. Criteria: LDH’s fee schedule outlines procedure codes for services and the applicable billing rates. Some services require that procedure codes also contain modifier codes which indicate information such as the age of the recipient, location where the service was provided, the educational background of the person providing the service, and the license(s) they have obtained. The approved fee schedules outline different rates depending on the procedure code and modifier codes. The MCOs can optionally pay more than the minimum LDH fee schedule. Cause: In following its corrective action plan from fiscal year 2022, LDH contracted with the External Quality Reviewer (EQR) to validate a representative sample of encounters against the Medicaid fee schedule on file at the time of service delivery, inclusive of modifier utilization. Implementation of this protocol began in fiscal year 2023 and has continued through fiscal year 2025. However, auditors noted that for the third year in a row the EQR’s analysis did not review the use of location modifiers in encounters. The billing errors could be avoided by LDH, the MCOs, and Magellan applying system edits that would flag encounters for further review when encounter coding and/or fee schedule requirements are not followed. Effect: Without the required modifiers, the encounter does not contain enough information to determine that the billing was appropriate. Because LDH does not currently maintain a list of these providers in which the MCO pays more than the minimum fee schedule, LDH cannot determine if an encounter paid at an excessive rate was improperly billed. It is important that encounter data is accurate because LDH and other stakeholders, such as the Medicaid Fraud Control Unit within the Attorney General’s Office, use this data to identify improper payments and potential fraud. LDH also uses this encounter data to establish per member per month (PMPM) rates for the MCOs. Recommendation: LDH management should ensure that agency personnel are adequately monitoring the EQR contract and that the proper validations are being conducted to ensure encounters are coded correctly. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-26).

2025-019 – Inadequate Internal Controls over Eligibility Determinations State Entity: Louisiana Department of Health (LDH) Award Years: 2020–2025 Award Numbers: 2005LA5MAP, 2105LA5MAP, 2205LA5MAP, 2305LA5MAP, 2405LA5021, 2405LA5MAP, 2505LA5021, 2505LA5MAP Compliance Requirements: Activities Allowed or Unallowed, Eligibility Repeat Finding: Yes (Prior Year Finding Nos. 2024-026, 2023-024, 2022-028, 2021-060, 2020-051) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the sixth consecutive year, LDH lacked adequate internal controls over eligibility determinations in the Medicaid program and CHIP program for the fiscal year ending June 30, 2025. From a population of 43,233,730 Medicaid PMPM and Fee-For-Service (FFS) payments totaling $8.9 billion, a nonstatistical sample of 60 Medicaid payments was selected, and the corresponding beneficiary’s eligibility was tested to ensure compliance with eligibility federal regulations. Discrepancies related to the beneficiary’s case records regarding eligibility determination and redetermination were identified for 20 (33%) of the 60 payments tested. The following errors were noted for Medicaid: • For one payment, inadequate or incorrect documentation was included in the case record to support the eligibility redetermination. • For 12 payments, LDH personnel did not accurately perform all required eligibility determinations before renewing the beneficiary. • For seven payments, LDH personnel did not accurately perform all required eligibility determinations before enrolling or renewing the beneficiary, resulting in the beneficiary being invalidly enrolled. In addition, from a population of 3,078,556 CHIP PMPM and FFS payments totaling $293 million, a nonstatistical sample of 60 CHIP payments were selected, and the corresponding beneficiary’s eligibility was tested to ensure compliance with eligibility federal regulations. Discrepancies related to the beneficiary’s case records regarding eligibility determination and redetermination were identified for 23 (38%) out of 60 payments tested. The following errors were noted for CHIP: • For three payments, inadequate or incorrect documentation was included in the case record to support the eligibility redetermination. • For 10 payments, LDH personnel did not accurately perform all required eligibility determinations before renewing the beneficiary. • For 10 payments, LDH personnel failed to accurately perform all required eligibility determinations before enrolling or renewing the beneficiary, resulting in the beneficiary being invalidly enrolled. Finally, an audit report issued in May of 2025 by the Louisiana Legislative Auditor’s Performance Audit Services (PAS) titled Progress Report: Medicaid Residency, concluded that LDH had not improved its processes to identify Medicaid beneficiaries who no longer reside in Louisiana and therefore no longer qualify for the Louisiana’s Medicaid program. As a result, LDH failed to discontinue coverage for three Medicaid beneficiaries who moved out of state. Criteria: 42 CFR 431, 42 CFR 435, and 42 CFR 457 require that, in order to be considered eligible, a beneficiary must meet all eligibility factors, and the beneficiary case record must include facts to support the agency’s eligibility decision. 42 CFR 435 and 42 CFR 457 also require annual renewal of eligibility. LDH has outlined eligibility criteria and documentation to support determinations and renewals in their Medicaid Eligibility Manual. Cause: LDH did not adhere to established control procedures to ensure case records support eligibility determination and redeterminations per the federal regulations and the Medicaid Eligibility Manual. Effect: Proper eligibility determination and redetermination are critical to ensuring appropriate service eligibility, appropriate premium payments, and appropriate federal match rate on expenditures. Questioned costs totaling $410,184 in federal funds in relation to the Medicaid beneficiaries who moved out of state, were invalidly enrolled, or whose renewal determination resulted in an erroneous certification of eligibility. Questioned costs totaling $13,224 in federal funds in relation to the CHIP beneficiaries who were invalidly enrolled or whose renewal determination resulted in an erroneous certification of eligibility. We did not note any questioned costs related to the other errors. Recommendation: LDH should ensure its employees follow procedures and federal regulations relating to eligibility determinations and redeterminations in the Medicaid and CHIP programs to ensure the case records support the eligibility decisions. Management’s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-28). Auditor’s Additional Comments: LDH noted in their response they did not concur with the errors noted for the Medicaid and CHIP renewals related to the Supplemental Nutrition Assistance Program (SNAP) not being properly documented. The errors noted relate to a weakness in internal controls as the system errors noted in the case records resulted in inadequate documentation to support the eligibility redetermination. LDH also did not concur with one Medicaid error for which there was no documentation of school enrollment for a beneficiary over age 18 on a Children’s Choice Waiver. The LDH Medicaid Eligibility Manual states that participants who reach age 18 and remain enrolled in school may continue to receive waiver services until their 21st birthday; participants currently receiving waiver services who reach age 18 and choose to no longer attend school may transition to a Supports Waiver. Therefore, documentation of school enrollment is necessary to determine the appropriate waiver services. For two of the CHIP errors, LDH did not concur that not all active income found in interfaces was counted in determining eligibility as LDH policy is to utilize the highest income reported by Louisiana Workforce Commission (LWC) at the time of processing. However, use of the policy without consideration of other available information may result in noncompliance. In the cases noted, the use of the highest income reported by LWC resulted in the use of incomplete or older returned income data, which affected the eligibility determinations.

2025-020 – Noncompliance with and Inadequate Controls over Subrecipient Monitoring Requirements State Entity: Louisiana Department of Health (LDH) Award Years: 2022–2025 Award Numbers: B08TI083534, B08TI083942, B08TI084581, B08TI085807, B08TI087039, B08TI088106 Compliance Requirement: Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The LDH Office of Behavioral Health (OBH) did not comply with subrecipient monitoring requirements for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program for the fiscal year ending June 30, 2025. SAPT program expenditures totaled $39.3 million during fiscal year 2025, with approximately $28.4 million provided to 10 subrecipients. While OBH identified the SAPT award name and assistance listing number to its subrecipients via an Interagency Transfer Agreement, the letter did not address all applicable requirements. In addition, OBH was unable to provide documentation of reviews performed to evaluate each subrecipient’s risk of noncompliance. Finally, OBH did not adequately monitor subrecipients to ensure expenditures were for allowable activities, allowable costs, and within the period of performance. Criteria: 2 CFR 200.303 requires non-federal entities receiving federal awards to establish, document, and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Subpart D of 45 CFR 75.352 requires pass-through entities to monitor activities of subrecipients. 2 CFR 200.332(b) requires the pass-through entity to clearly identify subawards to the subrecipient and convey certain required federal award information including requirements imposed by federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.332(c) requires the pass-through entity to evaluate each subrecipient’s risk of noncompliance. 2 CFR 200.332(e) requires the pass-through entity to monitor the activities of the subrecipients as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Cause: OBH did not have an adequate system of internal controls to ensure compliance with subrecipient monitoring requirements. Effect: Failure to perform adequate monitoring impairs OBH’s ability to ensure that program funds passed through to subrecipients are spent in accordance with program regulations and increases the risk of improper payments. Recommendation: OBH management should develop and strengthen its system of internal controls to ensure that subrecipients are provided with all required information, an evaluation is performed and documented to determine a subrecipient’s risk of noncompliance, and that all subrecipients are adequately monitored to ensure compliance with federal statutes, regulations, and the terms and conditions of the subaward. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-32).

2025-021 – Noncompliance with Disproportionate Share Hospital Payments State Entity: Louisiana Department of Health (LDH) Award Year: 2025 Award Number: 2505LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2024-028) See Schedule of Findings and Questioned Costs for chart/table. Condition: LDH exceeded the federally-allocated 2020 Disproportionate Share Hospital (DSH) funding limit by $3,162,186, resulting in federal questioned costs of $2,114,237. This is the second consecutive year that LDH exceeded a federally-allocated DSH funding limit. LDH makes payments for uncompensated costs to qualifying hospitals that serve a large number of Medicaid and uninsured individuals. These payments are known as DSH payments. Criteria: Section 1923 of the Social Security Act and LDH's State Plan Amendment 4.19 limit DSH payments on a state-wide basis to the annual DSH allotments. The allotment is capped and represents the maximum federal matching payments a state is permitted to claim. The allotment does not have to be spent in the specific allotment year but can be applied indefinitely until completely utilized. Cause: The overage occurred due to an inadequate reconciliation between the agency’s actual DSH expenditures and the federal allotment. LDH failed to consider additional payments previously made and federally reimbursed during their calculation of the remaining 2020 DSH federal allotment. Effect: The 2020 DSH funding limit was exceeded by $3,162,186, resulting in federal questioned costs of $2,114,237. Recommendation: LDH should ensure an adequate review of their calculations to verify that all federal payments are included to prevent the department from exceeding the federal DSH allotment in the future. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-35).

2025-022 – Noncompliance with Earmarking Requirements State Entity: Louisiana Department of Health (LDH) Award Years: 2021, 2023 Award Numbers: B08TI083942, B08TI085807 Compliance Requirement: Matching, Level of Effort, Earmarking Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: LDH, OBH exceeded certain earmarking requirements for the SAPT program. In our review of the four SAPT grants that ended during fiscal year 2025, two of the four grants exceeded the 5% maximum amount allowed to be expended related to intervention services for the HIV disease, resulting in federal questioned costs of $341,408. Criteria: 42 USC 300x-24(b)(4)(B) requires that states obligate and expend no more than 5% of the award to carry out one or more projects to make available to individuals early intervention services for HIV disease at the sites where the individuals are undergoing treatment. Cause: OBH did not effectively monitor the HIV expenditures to ensure earmarking requirements were not being exceeded. Effect: The HIV earmarked limit was exceeded by $341,408, resulting in federal questioned costs. Recommendation: OBH should strengthen its system of internal controls to ensure that earmarking requirements are not being exceeded for each SAPT grant awarded. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-37). Auditor’s Additional Comments: Although management acknowledged expenditures exceeded the HIV set-aside limit, management did not concur with the total amount of questioned costs. Management responded that $157,111 of the $341,408 questioned costs was not applicable due to Substance Abuse and Mental Health Services Administration’s decision to terminate the Substance Use Prevention, Treatment, and Recovery Services American Rescue Plan Act Supplement grant for cause, which removed the obligation to meet requirements for those services. At the time of termination, the 5% maximum amount based on the grant allotment had already been exceeded. In addition, no documentation was provided to support the earmarking requirement was no longer applicable for this grant.

2025-023 – Noncompliance with Fee-for-Service Provider Revalidation Requirements State Entity: Louisiana Department of Health (LDH) Award Years: 2024, 2025 Award Numbers: 2405LA5021, 2405LA5MAP, 2505LA5021, 2505LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: LDH did not timely perform revalidations as required by federal regulations for all Medicaid and CHIP fee-for-service (FFS) providers. LDH contracted with Gainwell Technologies, LLC. (Gainwell) to revalidate providers. In our review of portal system reports for all providers required to be revalidated during the fiscal year ending June 30, 2025, we noted the following: • 134 (100%) of 134 Durable Medical Equipment providers that were required to be revalidated during or prior to fiscal year 2025 did not have a revalidation completed within the required three-year timeframe. Providers were revalidated between 21 and 161 days late. • 3 (75%) of 4 other providers that were required to be revalidated during or prior to fiscal year 2025 did not have a revalidation completed within the five-year timeframe. Providers were revalidated between 515 and 791 days late. Criteria: 42 CFR 424.57(g) requires that providers of durable medical equipment, prosthetics, orthotics and supplies revalidate their application for billing privileges every three years after billing privileges are first granted. 42 CFR 455.414 requires the State Medicaid agency to revalidate the enrollment of all providers regardless of provider type at least every five years. Cause: LDH did not adequately monitor their contractor, Gainwell, to ensure revalidations were being completed timely. Effect: Improper provider revalidation could prevent the state from timely identifying ineligible providers that should be rejected or excluded from participation in the program. Recommendation: LDH should adequately monitor the contractor to ensure all providers are revalidated within the required timeframe in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-39).

2025-024 – Noncompliance with Managed Care Provider Enrollment and Screening Requirement State Entity: Louisiana Department of Health (LDH) Award Years: 2024, 2025 Award Numbers: 2405LA5021, 2405LA5MAP, 2505LA5021, 2505LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding Nos. 2024-029, 2023-026, 2022-029, 2021-061, 2020-052, 2019-030, 2018-028) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the eighth consecutive year, LDH did not enroll and screen all Healthy Louisiana managed care providers and dental managed care providers, as required by federal regulations. In our review of the 15,219 providers paid during fiscal year 2025, it was determined that 950 (6%) of managed care and dental managed care providers were not enrolled and screened in accordance with federal regulations. Criteria: 42 CFR 438.602 (2016 Managed Care Final Rule) and Section 5005 of the 21st Century Cures Act require that the enrollment process includes providing the Medicaid agency with the provider’s identifying information including the name, specialty, date of birth, Social Security number, national provider identifier, federal taxpayer identification number, and state license or certification number of the provider. Additionally, the state agency is required to screen enrolled providers, require certain disclosures, provide enhanced oversight of certain providers, and comply with reporting of adverse provider actions and provider terminations. By using the federally-required process, managed care providers must participate in the same screening and enrollment process as Medicaid and CHIP fee-for-service providers. Cause: In July 2021, LDH launched the enrollment portal created by Gainwell, the state’s current provider enrollment vendor. Although the enrollment portal was launched in fiscal year 2022 for existing providers as of March of 2022, new providers were not invited to enroll, as this required an amendment to the contract with Gainwell and additional costs. An amendment to the contract was approved in October of 2024 and required Gainwell to maintain compliance with the 21st Century Cures Act and ensure all Medicaid health care providers are enrolled with the State Medicaid Agency, subject to a risk-based screening, and revalidated every five years. LDH began the process of inviting providers to the portal in October of 2024 but did not complete sending invitations until March 2025. Therefore, not all of the Healthy Louisiana managed care providers and dental managed care providers that received payments in fiscal year 2025 were enrolled and screened prior to June 30, 2025. Effect: LDH cannot ensure the accuracy of provider information obtained from the Louisiana Medicaid managed care plans and cannot ensure compliance with enrollment requirements defined by law and the Medicaid and CHIP state plan. Recommendation: LDH should ensure all providers are screened and enrolled as required by federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-41).

2025-025 – Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act State Entity: Louisiana Department of Health (LDH) Award Year: 2025 Award Number: B08TI088106 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: LDH, OBH did not comply with FFATA reporting requirements for the SAPT program. As of June 30, 2025, OBH had not entered subaward information into the Federal system for 10 subawards of $30,000 or more totaling $23,457,985. Criteria: 2 CFR Part 170, Appendix A(I)(a) requires the non-federal entity to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity into the FFATA Subaward Reporting System no later than the end of the month following the month in which the obligation was made. 2 CFR 200.303 requires non-federal entities receiving federal awards to establish, document, and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Cause: OBH did not have an adequate system of internal controls to ensure compliance with FFATA reporting requirements. Effect: Noncompliance with FFATA reporting requirements prevents the public from having access to accurate and timely information regarding the administration of federal awards. Recommendation: OBH should develop and strengthen its system of internal controls to ensure that appropriate personnel are timely entering the required award information for FFATA reporting in accordance with federal requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-43).

2024-003 - Control Weakness and Noncompliance Related to Cost Allocation Process State Entity: Department of Children and Family Services (DCFS) Award Years: 2018, 2023, 2024 Award Numbers: 1804LACEST, 2301LASOSR, 2401LACSES, 2401LAFOST, 2401LASOSR, 2401LATANF, SNAP - Letter of Credit Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: Yes (Prior Year Finding No. 2023-003) See Schedule of Findings and Questioned Costs for chart/table. Condition: The Department of Children and Family Services (DCFS) did not have adequate controls in place to ensure the correct allocation of expenditures in accordance with the Cost Allocation Plan, which assigns costs to federal programs. In a non-statistical sample of 60 cost allocation forms out of a population of 921 forms, three (5%) forms used percentages from a prior month and amounts were applied to the incorrect cost allocation grant, which resulted in the incorrect allocation of costs to various cost pools affecting multiple federal programs. These errors resulted in overbilling Temporary Assistance for Needy Families program by $1,907, Child Support Services (CSS) program by $1,161, State Administrative Matching Grants for the Supplemental Nutrition Assistance Program (SNAP) by $389, Foster Care Title IV-E program by $1,216, and Social Services Block Grant program by $12. The amounts overbilled represent questioned costs. In addition, the CSS and SNAP programs were underbilled by $621 and $4,684, respectively. Criteria: 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Per 2 CFR 200.400(d), the accounting practices of the non-federal entity must be consistent with cost principles and support the accumulation of costs as required and must provide for adequate documentation to support costs charged to the federal award. Cause: These errors occurred because there was not an effective review process in place to identify amounts being charged incorrectly through the cost allocation process. Effect: Failure to adequately review cost allocation supporting documentation increases the risk that unallowable costs could be charged to federal programs. This is the second consecutive year we have reported to DCFS management exceptions with internal controls related to the cost allocation process. Recommendation: Management should strengthen internal controls over the cost allocation review process. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-2).

2024-004 – Noncompliance and Weakness in Controls with Special Tests and Provisions Requirements State Entity: Louisiana State University Health Sciences Center - Shreveport (LSUHSC-S) Award Years: Various Award Numbers: Various Compliance Requirement: Special Tests and Provisions Pass-Through Entities: Various Repeat Finding: Yes (Prior Year Finding No. 2023-029) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the sixth consecutive year, Louisiana State University Health Sciences Center in Shreveport (LSUHSC-S) did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. We reviewed a non-statistical sample of 12 federal Research and Development Cluster awards from a population of 61 awards, plus two additional awards based on materiality, for the fiscal year ending June 30, 2024. We reviewed the biannual Time and Effort Certification forms, as applicable, for each award and the 27 key personnel assigned to the selected awards. We noted two of 27 (7.4%) key personnel had documentation indicating that the key personnel were removed from the grant and/or had documentation of actual effort on the Time and Effort Certification forms that did not agree to the effort reported to the federal grantor. There was also no evidence of prior approval from the federal grantor for a change in key personnel. Criteria: 2 CFR 200.308(f) states that a recipient or subrecipient must request prior written approval from the federal agency or pass-through entity for the following program and budget-related reasons: • Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). • Change in key personnel (including employees and contractors) that are identified by name or position in the federal award. • The disengagement from a project for more than three months, or a 25% reduction in time and effort devoted to the federal award over the course of the period of performance, by the approved project director or principal investigator. Cause: LSUHSC-S’s controls are not effectively designed to ensure prior approval is obtained for changes in effort by key personnel as required by federal regulations, specifically relating to disengagement from a project for more than three months or a 25% reduction in effort. This is partially due to LSUHSC-S revising its Time & Effort Certification policy in September 2022, which changed the frequency of the certification from quarterly to semiannually. Effect: Failure to implement controls over key personnel requirements could result in noncompliance with Special Tests and Provisions requirements. Recommendation: Management should monitor changes in effort for key personnel and verify that prior written approval is obtained from the federal grantor for changes that exceed the thresholds set in federal regulations. Management should revise the Time & Effort Certification policy or implement alternative controls designed to ensure compliance with Special Tests and Provisions requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-45).

2024-005 - Noncompliance with and Weakness in Controls over Federal Research and Development Expenses State Entity: Louisiana State University Health Sciences Center - Shreveport (LSUHSC-S) Award Years: Various Award Numbers: Various Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management Pass-Through Entities: Various Repeat Finding: Yes (Prior Year Finding No. 2023-006) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the sixth consecutive year, LSUHSC-S did not ensure internal controls over documentation of personnel services were operating effectively, and did not ensure compliance with federal guidance regarding cost transfers applicable to the Research and Development (R&D) Cluster. In a non-statistical random sample of 27 out of 2,933 payroll adjusting entries affecting R&D, we noted the following exceptions for 15 adjusting entries, some of which had multiple exceptions: • Seven (26%) adjustments did not have adequate documentation to fully explain how the error occurred and/or the transfer was not accomplished within 90 days of when the error was discovered. • For five (19%) adjustments, LSUHSC-S did not provide sufficient information to determine if the cost transfers were completed timely. • For three (11%) adjustments, LSUHSC-S did not provide sufficient information to verify the new charge was certified by a responsible organizational official. • For three (11%) adjustments, LSUHSC-S did not provide sufficient documentation to determine whether adjustments were allowable per the award, which resulted in questioned costs totaling $2,686. • For twelve (44%) adjustments, LSUHSC-S did not provide sufficient documentation to evidence that expenses were incurred prior to reimbursement and that funds were returned to the federal agency for expenses that were removed from the federal award. We also performed an analysis of interim payroll adjusting journal entries to record cost transfers to and/or from R&D awards. We noted that 465 (20%) out of 2,309 adjusting journal entries were made more than 90 days after the end of the biannual period from the original transactions. The adjustments were made 103 to 430 days after the end of the biannual period. In addition, in a non-statistical random sample of 53 out of 11,272 expense transactions charged to R&D during the fiscal year ending June 30, 2024, we noted the following exceptions for 10 transactions, some of which had multiple exceptions: • Six (11%) time and effort certifications for salary and related benefit expenses tested were completed 92 to 248 days after the end of the biannual period, or LSUHSC-S did not provide sufficient documentation to determine that the certifications were completed timely. • For one (2%) transaction, LSUHSC-S did not provide documentation approving the employee’s salary on the applicable award. • For four (8%) transactions, LSUHSC-S did not provide documentation that indicated expenses were reconciled and approved prior to submitting reimbursement requests. Additionally, for three of these transactions, LSUHSC-S did not provide sufficient support to determine if the expenses were incurred prior to the reimbursement request or if LSUHSC-S minimized the time that elapsed between the transfer of funds from the federal government and LSUHSC-S’s disbursement for federal program purposes Finally, it was noted during our procedures related to requisition transactions that LSUHSC-S lacked proper segregation of duties in the online requisition process. We noted in an analysis of all requisition transactions that are subject to online approvals (14,941 transactions totaling $25,349,749) that 4,916 transactions totaling $7,222,206 (28%) did not have adequate segregation of duties. Of these, 306 transactions totaling $338,679 related to the R&D Cluster. Criteria: 2 CFR 200.430(i)(1)(i) requires that charges to federal awards for salaries and wages must be supported by a system of internal control which provides reasonable assurance the charges are accurate, allowable, and properly allocated. Per 2 CFR 200.430(i)(1)(viii), budget estimates alone do not qualify as support for charges to federal awards, but may be used for interim accounting purposes, provided that the system for establishing the estimates produces reasonable approximations of the activity performed, significant changes in work activity are identified and entered into the records in a timely manner, and the non-federal entity’s system of internal controls includes processes to review after-the-fact interim charges and make necessary adjustments. Per LSUHSC-S’s Time and Effort Certification Policy and Procedures, LSUHSC-S utilizes time and effort certifications to support salary charges to sponsored projects as an after-the-fact certification of effort of all individuals when all or a portion of their salaries are charged to a sponsored project. Based on LSUHSC-S’s policy, time and effort certifications should be completed within approximately 90 days of the end of the biannual period. Management interprets the end of the period to be when the time and effort reports are sent to the departments once the last month of the biannual period is closed in the accounting system. If there is a substantial (five percent or more) difference between the salary charges and the effort actually expended by the individual on projects during the biannual reporting period, a payroll reallocation must be created within 30 days. Per 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission. Per the Standards for Internal Control in the Federal Government, examples of common categories of control activities include accurate and timely recording of transactions. In addition, the National Institutes of Health (NIH) is the grantor for the majority of the LSUHSC-S’s R&D grant awards. Per the NIH Grants Policy Statement §7.5, cost transfers that represent corrections of clerical or bookkeeping errors should be accomplished within 90 days of when the error was discovered. The transfers must be supported by documentation that fully explains how the error occurred and a certification of the correctness of the new charge by a responsible organizational official. An explanation merely stating that the transfer was made “to correct error" or "to transfer to correct project" is not sufficient. Transfers of costs from one project to another or from one competitive segment to the next solely to cover cost overruns are not allowable. Cause: LSUHSC-S faculty are not completing time and effort certifications timely, which contributes to untimely adjustments for compensation. In addition, LSUHSC-S did not provide sufficient supporting documentation for the auditor to test federal regulations related to cash management for all sample items selected due to an insufficient method for sorting and storing the documentation related to each federal award. Finally, the lack of segregation of duties was caused by LSUHSC-S granting certain employees’ access that allowed for self-approvals. Effect: Untimely certifications and the untimely discovery and correction of errors increases the risk of inaccurate reporting and may result in an inability to complete approved projects within the approved budget and/or period of performance. As a result, LSUHSC-S may have to utilize university funds to complete approved projects. In addition, inadequate controls and noncompliance with federal awards increases the likelihood of disallowed costs, which LSUHSC-S may have to repay to the federal grantor. Recommendation: Management should ensure they have adequate controls over time and effort certifications, purchases, and reimbursement requests. In addition, management should ensure adequate segregation of duties covering approvals of all transaction types. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-47).

2024-006 - Control Weakness and Noncompliance with Personnel Expenses Charged to Federal Awards State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2020, 2021, 2022 Award Numbers: 1R01MH125395, 2046460, R37AI094595 Compliance Requirements: Allowable Costs/Cost Principles; Special Tests and Provisions Pass-Through Entity: Northwestern University Repeat Finding: Yes (Prior Year Finding No. 2023-007) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fourth consecutive year, the University of Louisiana at Lafayette (UL Lafayette) did not have adequate controls in place to ensure personnel expenses charged to federal Research and Development (R&D) awards accurately reflected work performed. From a population of 14,024 payroll and non-payroll expenses charged to R&D grants for the fiscal year ending June 30, 2024, a non-statistical sample of 25 transactions were tested for compliance with allowable costs and cost principles requirements. For three (12%) of the payroll transactions, UL Lafayette was unable to provide documentation to show that personnel-related expenses totaling $18,707 were supported by time and effort certifications to ensure the accuracy of budget estimates charged to federal awards as required by federal regulations. Additionally, UL Lafayette did not perform time and effort certifications for the period January 1, 2024, through June 30, 2024. Because there is no after-the-fact review to ensure the accuracy of personnel costs and efforts charged to the awards, UL Lafayette could not ensure compliance with the requirements of special tests and provisions related to key personnel effort. Criteria: 2 CFR 200.430(i) specifies the documentation standards for personnel expenses. In order to be allowable, charges to federal awards for personnel expenses must be based on records that accurately reflect the work performed and must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Budget estimates alone do not qualify as support for charges to federal awards, but can be used for interim accounting purposes provided that internal controls include an after-the fact review to confirm the accuracy of final amounts charged to federal awards. Prior approval requirements related to key personnel effort are contained in 2 CFR 200.308(c) and within grant terms and conditions. A reduction of 25% or greater in time devoted to the project from key personnel requires prior approval, as does disengagement of key personnel from the project for three or more months. Cause: UL Lafayette noted in their prior-year corrective action that certifications for employees charging time to federal awards would be required annually. Annual certifications are not sufficient to timely detect changes in key personnel effort and ensure prior approvals are obtained when applicable. Furthermore, UL Lafayette noted that the next effort reporting cycle would cover July 1, 2023, through December 31, 2023. The time certification period only covered half of the audit period. As a result, time and effort certifications were not completed by employees on the latter half of the audit period to support that the charges to federal awards for salaries and wages were based on records that accurately reflect the work performed during this period. Effect: Inadequate controls related to federal documentation standards for personnel expenses could result in noncompliance with federal allowable costs and cost principles, as well as noncompliance with special tests and provisions related to key personnel effort. Recommendation: Management should strengthen internal controls to ensure that personnel expenses charged to the federal awards are supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Additionally, Management should revise the Time & Effort Certification policy and/or implement alternative controls designed to ensure compliance with Special Tests and Provisions requirements. Management should monitor changes in effort for key personnel and ensure that prior written approval is obtained from the federal grantor for changes that exceed the thresholds set in federal regulations. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-60).

2024 -007 - Noncompliance with Period of Performance Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2021, 2022 Award Numbers: 80NSSC21M0165, DE-FE0031919 Compliance Requirement: Period of Performance Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: UL Lafayette did not ensure that all expenses charged to federal Research and Development (R&D) awards complied with the period of performance requirements. From a population of 166 R&D grants with expenses totaling $6,720,454 and periods of performance starting or ending during the fiscal year ending June 30, 2024, a non-statistical sample of 17 grants was tested for compliance with period of performance requirements. For two (11.8%) of the 17 grants tested, expenses totaling $63,790 were identified as noncompliant with the period of performance requirements. One grant had expenses totaling $28,833 that were incurred after the period of performance. For the other grant, UL Lafayette failed to liquidate obligations totaling $34,957 incurred during the period of performance within 120 days after the end the period of performance as required by federal regulations. Criteria: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance [2 CFR sections 200.308, 200.309, and 200.403(h)]. Additionally, 2 CFR 200.344 states that the recipient must liquidate all financial obligations incurred under the federal award no later than 120 calendar days after the conclusion of the period of performance. Cause: UL Lafayette did not have sufficient internal controls to ensure that only expenses incurred during the period of performance were charged to R&D grants and that obligations were liquidated timely. Effect: Noncompliance with the period of performance requirements resulted in $63,790 in questioned costs and increases the risk that expenses could be disallowed and not reimbursed by the awarding agency. Recommendation: Management should strengthen their procedures and internal controls that are in place to ensure that all expenses incurred on federal R&D grants comply with the period of performance requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-62).

2024-008 - Noncompliance with Subrecipient Monitoring Requirements State Entity: University of Louisiana at Lafayette (UL Lafayette) Award Years: 2019 - 2023 Award Numbers: DE-EE0009421, FA9550-21-1-0215, M19AC00015, OIA-1920858, OIA-2019511, OIA-2119688, U19AI142636 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2023-008) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fourth consecutive year, UL Lafayette did not adequately monitor subrecipients of the Research and Development (R&D) Cluster Programs. In a non-statistical sample of seven subawards out of a population of 50 subawards, it was noted that for six (85.7%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed by UL Lafayette. For three (42.9%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipients’ fraud risk and risk of noncompliance with federal regulations and the terms of the subaward. For two of the subrecipients reviewed (28.6%), UL Lafayette was unable to provide documentation that ensured each subrecipient obtained the required audit and that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Additionally, for one (14.3%) of the subrecipients evaluated, the subaward documents did not contain the federal award date as required by federal regulations. Criteria: Per 2 CFR 200.332(b)(1)(iv), all pass-through entities must ensure that every subaward includes the federal award date. 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. 2 CFR 200.332(e)(1) requires that pass-through monitoring include reviewing financial and performance reports required by the pass-through entity. 2 CFR 200.332(e)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings, in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient’s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Per 2 CFR 200.332(g), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR Part 200, subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in CFR 200.501 of $750,000 or more in federal awards during the subrecipient’s fiscal year. Cause: UL Lafayette did not have sufficient controls in place to adequately monitor subrecipients as required by federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls to ensure that all required financial and performance reports are obtained and reviewed and that all required subrecipient audit reports are obtained and reviewed in order to evaluate the impact of any findings noted by the audit and issue management decision letters, if applicable. In addition, UL Lafayette should strengthen controls to ensure that required information is included in the subaward documents and that risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-64).

2024-009 – Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act State Entity: Executive Department – Division of Administration – Office of Community Development Award Years: 2016, 2021, 2023 Award Numbers: B-16-DL-22-0001, B-21-DF-22-0001, B-21-DZ-22-0001, B-23-DC-22-0001 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Division of Administration, Office of Community Development – Local Government Assistance (OCD-LGA) and Office of Community Development-Disaster Recovery (OCD-DR) did not comply with Federal Funding Accountability and Transparency Act (FFATA) Reporting requirements for the Community Development Block Grant/State’s Program (CDBG). During fiscal year 2024, OCD-LGA approved 41 subawards totaling approximately $22 million to 40 different subrecipients, and OCD-DR approved 33 subawards totaling approximately $310.9 million to 32 different subrecipients. Our procedures identified the following: • In a sample of eight OCD-LGA subawards, none of the eight subaward obligations were reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) until 39 to 62 days after the required time frame. • Of the 10 OCD-DR subawards tested, four obligations reported in FSRS were not reported until 5 to 86 days after the required time frame. See Schedule of Findings and Questioned Costs for chart/table. Criteria: 2 CFR Part 170, Appendix A, requires the non-federal entity to report to FSRS each obligating action equal to or exceeding $30,000 for a subaward. In addition, the subaward information must be reported no later than the end of the month following the month in which the obligation was made. 2 CFR Part 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with relevant requirements. Cause: OCD-LGA management stated that they were unable to submit the reports in FSRS timely. OCD-DR management stated that the infrequency of preparation of the FFATA reports caused the required FFATA reports to be submitted untimely to FSRS. Both OCD-LGA and OCD-DR did not maintain adequate internal controls to ensure compliance with FFATA reporting requirements. Effect: Not complying with the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding OCD-LGA and OCD-DR’s administration of federal awards. Recommendation: OCD-LGA and OCD-DR management should ensure that established internal controls are operating to ensure compliance with FFATA reporting requirements, which includes the timely submission of information. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-6).

2024-010 - Inadequate Controls over and Noncompliance with Subrecipient Monitoring Requirements State Entity: Louisiana Workforce Commission (LWC) Award Years: 2021 - 2024 Award Numbers: 23A55AT000024, 23A55AW000027, 23A55AY000034, AA363222155A22, AA385322255A22 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2023-012) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the sixth consecutive year, the Louisiana Workforce Commission (LWC) did not adequately monitor subrecipients under the Workforce Innovation and Opportunity Act (WIOA) Cluster programs. LWC did not ensure that subrecipients’ Single Audit reports were submitted timely to the Federal Audit Clearinghouse (FAC) and ensure timely issuance of management decisions on findings affecting the WIOA Cluster programs. LWC’s total WIOA expenditures during state fiscal year 2024 totaled more than $50 million, with approximately $40.7 million provided to subrecipients. Our review of LWC’s monitoring of Single Audit reports disclosed the following for LWC’s 15 subrecipients: • Three Single Audit reports were submitted to the FAC between 7 and 64 days after the deadline set by federal regulations. • For an additional three Single Audit reports, each with findings affecting the WIOA cluster of programs, management decision letters were issued between 148 and 216 days after the deadline set by federal regulations. Criteria: 2 CFR 200.512(a) requires that Single Audit reports be submitted within the earlier of 30 calendar days after receipt of the auditor’s report or nine months after the end of the audit period. 2 CFR 200.521(c) requires that pass-through entities issue management decisions for audit findings related to federal awards they make to subrecipients. 2 CFR 200.521(d) requires that pass-through entities responsible for issuing management decisions issue their management decisions within six months of the acceptance of the audit report by the FAC. Cause: LWC did not ensure that subrecipients’ Single Audit reports were submitted timely to the FAC and ensure timely issuance of management decisions on findings affecting the WIOA Cluster programs. Effect: Failure to implement adequate internal controls to ensure that subrecipients’ Single Audit reports are submitted and required management decision letters are issued by the deadlines established in federal regulations impairs LWC’s ability to ensure that program funds passed through to its subrecipients were spent in accordance with program regulations and increases the risk of improper payments to subrecipients, which LWC may have to repay to the federal grantor. Recommendation: LWC management should implement adequate internal controls to ensure that subrecipients’ Single Audit reports are submitted to the FAC in a timely manner and required management decision letters are issued by the due date set by federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-50).

2024-011 - Noncompliance and Inadequate Controls Related to Reporting Requirements for the Federal Funding Accountability and Transparency Act State Entity: Louisiana Workforce Commission (LWC) Award Year: 2024 Award Numbers: 23A55AT000024, 23A55AW000027, 23A55AY000034 Compliance Requirement: Reporting Repeat Finding: Yes (Prior Year Finding No. 2023-013) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the second consecutive year, for Workforce Innovation and Opportunity Act (WIOA) Cluster programs, LWC did not have adequate internal controls in place to review and approve data submissions to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) website required for federal subawards by FFATA. LWC had 15 subawards totaling $35.7 million executed in state fiscal year 2024. The data submissions for 11 of the 15 subawards occurred between one and two months after the due date specified by federal regulations. The 11 subawards submitted late each exceeded $30,000 and collectively totaled more than $25.2 million. In addition, LWC entered into the FSRS website an incorrect subaward amount for two subawards. The error resulted in an underreporting of the subawards totaling $79,207. Criteria: 2 CFR 200.303 requires non-federal entities receiving federal award to establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 170, Appendix A(I)(a) requires the non-federal entity to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity into the FSRS website no later than the end of the month following the month in which the obligation was made. The amount of the subaward is one of the key data elements identified by federal regulations for FFATA data submissions. Cause: LWC management represented that a staff member, other than the compiler of the data that was submitted, observed the data as it was being submitted to the FSRS website and reviewed and approved it as complete and accurate based on this observation. However, management was not able to provide evidence of the review and approval of the data submission. In addition, as noted above, the data submissions occurred after the due date specified in federal regulations and included erroneous amounts for two subawards. Effect: Failure to implement adequate internal controls over the data submissions to the FSRS website as required by the FFATA could result in required data submissions being incomplete, inaccurate, and/or untimely, as evidenced by the late and erroneous data submissions noted above, which resulted in noncompliance with federal regulations. Recommendation: LWC should strengthen controls, including maintaining evidence of reviews, to ensure compliance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-52).

2024-012 – Failure to Return Title IV Funds in Required Time Frames State Entity: Louisiana State University at Shreveport (LSU-S) Award Years: 2015 - 2024 Award Numbers: P063P191517, P063P201517, P063P211517, P063P221517, P063P231517, P268K201517, P268K211517, P268K221517, P268K231517, P268K241517 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: Louisiana State University at Shreveport (LSU-S) failed to return Title IV funds to the U.S. Department of Education (USDOE) within the required timeframes. In January 2025, management identified $101,159 of outstanding checks to students or parents, issued from September 2014 to May 2024, that were not returned to the USDOE as required by federal regulations. Criteria: Per 34 CFR 668.164(l): (1) Notwithstanding any state law (such as a law that allows funds to escheat to the state), an institution must return to the Secretary any Title IV, Health Education Act program funds, except Federal Work Study (FWS) program funds, that it attempts to disburse directly to a student or parent that are not received by the student or parent. For FWS program funds, the institution is required to return only the federal portion of the payroll disbursement. (2) If an electronic funds transfer (EFT) to a student's or parent's financial account is rejected, or a check to a student or parent is returned, the institution may make additional attempts to disburse the funds, provided that those attempts are made not later than 45 days after the EFT was rejected or the check returned. In cases where the institution does not make another attempt, the funds must be returned to the secretary before the end of this 45-day period. (3) If a check sent to a student or parent is not returned to the institution but is not cashed, the institution must return the funds to the secretary no later than 240 days after the date it issued the check. Cause: Management represented that their practice is to follow-up with the student or parent and encourage them to deposit their checks, but there are no procedures in place to follow-up and ensure the funds are returned to the USDOE within the required timeframe. Effect: Failure to timely return Title IV funds to the USDOE results in noncompliance with federal regulations and could result in disallowed costs. Recommendation: Management should develop and implement a process to return all Title IV funds that are not received by a student or parent to the USDOE within the required timeframes set by federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-39).

2024-013 – Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security State Entity: Louisiana State University at Shreveport (LSU-S) Award Years: 2023, 2024 Award Numbers: P063P221517, P063P231517, P268K231517, P268K241517 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: LSU-S did not develop, implement, and maintain a comprehensive information security program to address the minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information. Criteria: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) requires institutions that participate in Title IV Educational Assistance Programs to safeguard customers’ sensitive data in accordance with 16 CFR 314. 16 CFR 314.3 requires institutions to develop, implement, and maintain a comprehensive information security program that contains administrative, technical, and physical safeguards that are appropriate for the university. The information security program should include certain elements required by federal regulations reasonably designed to: • insure the security and confidentiality of customer information; • protect against any anticipated threats or hazards to the security or integrity of such information; and • protect against unauthorized access of such information that could result in substantial harm or inconvenience to any customer. Cause: Management represents that it has prepared a draft information security program policy statement but acknowledges that the policies have not been finalized or implemented. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction or other compromise of student information and results in noncompliance with federal regulations. Recommendation: Management should develop, implement, and maintain an information security program to insure the security and confidentiality of student information and to protect against any anticipated threats or hazards to the security or integrity of such information. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-40).

2024-014 - Control Weakness over Direct Loans Monthly Reconciliations State Entity: Louisiana State University Health Sciences Center – New Orleans (LSUHSC-NO) Award Year: 2024 Award Number: P268K241518 Compliance Requirement: Cash Management Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: Louisiana State University Health Sciences Center – New Orleans (LSUHSC-NO) did not timely reconcile the U.S. Department of Education’s (USDOE) loan information to the institution’s financial records on a monthly basis for the Federal Direct Student Loans program. Each month, USDOE’s Common Origination and Disbursement (COD) system provides the institution the School Account Statement data files, which should reconcile back to USDOE’s grants management system (G5 system) Draw Down reports and the institution’s financial records to ensure the institution has transmitted accurate and complete student data to the COD system for all Federal Direct Student Loan borrowers in accordance with federal requirements. During fiscal year 2024, audit procedures revealed that three of 12 (25%) monthly direct loan reconciliations were not completed timely, ranging from 29 to 91 days past the end of the next month. In addition, five of 12 (42%) were not reviewed timely, ranging from 14 to 155 days after the end of the next month. Criteria: 34 CFR 685.300(b)(5) requires that schools must, on a monthly basis, reconcile institutional records with Federal Direct Student Loan funds received and disbursement records submitted to and accepted by the USDOE. Per the 2023-2024 Federal Student Financial Aid Handbook (Vol. 4, Ch. 6), a school that participates in the Federal Direct Student Loan Program is required monthly to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the COD system. Cause: LSUHSC-NO did not have adequate controls in place to ensure timely preparation and review of monthly Direct Loan reconciliations. Effect: Failure to perform the monthly reconciliations timely could result in LSUHSC-NO reporting inaccurate information to the COD system and place LSUHSC-NO in noncompliance with Direct Loan federal regulations. In addition, failure to reconcile to the G5 system could affect the overall cash management controls. Recommendation: Management should strengthen its controls to ensure LSUHSC-NO timely prepares and reviews monthly reconciliations of the institution’s financial and business records to the G5 and COD systems. Management’s Response and Corrective Action Plan: Management concurred in part and provided a corrective action plan (B-41).

2024-015 - Inaccurate Reporting of Student Enrollment Status State Entity: Louisiana State University Health Sciences Center – New Orleans (LSUHSC-NO) Award Year: 2024 Award Number: P268K241518 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: LSUHSC-NO did not ensure changes in enrollment status for students who received Federal Direct Student Loans were accurately and timely reported to the National Student Loan Data System (NSLDS), as required by federal regulations. In a non-statistical sample of 60 students tested for changes in enrollment from a population of 671 students with changes in enrollment status, we noted the following: • Six (10%) students had inaccurate enrollment statuses reported in the NSLDS, and • Seven (12%) students’ enrollment status changes were not reported timely, ranging from 29 to 107 days late. Criteria: 34 CFR 685.309 requires, unless an institution expects to submit its next updated enrollment report to the U.S. Department of Education (USDOE) within the next 60 days, a school must notify the USDOE within 30 days after the school discovers that a loan under Title IV was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended. Cause: LSUHSC-NO did not have proper controls in place to ensure changes in enrollment status for students who received Federal Direct Student Loans were accurately and timely reported to NSLDS. Effect: Inaccurate and untimely reporting of changes in enrollment status could impact the student’s financial aid eligibility and result in either the advance or delay of a student’s grace period or obligation to begin or resume making scheduled loan payments, which could impair the federal government’s ability to recoup loan funds from the student and results in noncompliance with federal regulations. Recommendation: Management should strengthen its procedures over changes in enrollment status for students receiving Federal Direct Student Loans and report accurate and timely information to NSLDS. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a plan of corrective action (B-43).

2024-016 - Control Weakness over and Noncompliance with Enrollment Reporting State Entity: Southern University at Baton Rouge (SUBR) Award Year: 2024 Award Numbers: P063P231525, P268K241525 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: Southern University at Baton Rouge (SUBR) did not ensure changes in enrollment status for students who received Federal Pell Grant Program funds and/or Federal Direct Student Loans were accurately and timely reported to the National Student Loan Data System (NSLDS), as required by federal regulations. In a non-statistical sample of 60 students tested for changes in enrollment status from a population of 1,124 students, the following was identified: • 17 (28%) students had incorrect enrollment information. Six students had an NSLDS program length that did not agree to the SUBR catalog, and 11 students had incorrect enrollment statuses reported. • 27 (45%) students did not have their enrollment changes correctly updated within 60 days. Criteria: 34 CFR 685.309(b)(2), related to Federal Direct Student Loans, requires, unless it expects to submit its next updated enrollment report to the U.S. Department of Education (USDOE) within the next 60 days, a school must notify the USDOE within 30 days after the date the school discovers that a loan under Title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended. 34 CFR 690.83(b)(2), related to the Federal Pell Grant Program, requires an institution to submit, in accordance with deadline dates established by the USDOE through publication in the Federal Register, other reports and information the USDOE requires and to comply with the procedures the USDOE finds necessary to ensure that the reports are correct. The section titled Deadline Dates for Enrollment Reporting by Institutions in the Federal Register (88 FR 41092) refers to the NSLDS Enrollment Reporting Guide. The NSLDS Enrollment Reporting Guide, section 1.4, requires the institution to certify enrollment every 60 days. Cause: SUBR did not have proper controls in place to ensure changes in enrollment status for students who received Federal Pell Grant Program funds and Federal Direct Student Loan funds were accurately and timely reported to NSLDS. In addition, when SUBR attempted to submit the enrollment report, there was a file structure error preventing the data from being submitted timely. Effect: Inaccurate and untimely reporting of changes in enrollment status could impact the student’s Pell Grant or student loan eligibility and result in noncompliance with federal regulations. For students moving into repayment, reporting of changes in enrollment status affects when the grace period begins and how soon a student must begin repaying loan funds. Recommendation: Management should strengthen its procedures over changes in enrollment status for students receiving Federal Pell Grant Program funds and Federal Direct Student Loans to ensure SUBR reports accurate and timely information to NSLDS. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-54).

2024-017 - Control Weakness over and Noncompliance with Return of Title IV Funds State Entity: Southern University at Baton Rouge (SUBR) Award Year: 2024 Award Numbers: P063P231525, P268K241525 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: SUBR did not have adequate controls in place to ensure that the return of Title IV funds were properly calculated and returned to the U.S. Department of Education (USDOE) as required by federal regulations. In addition, post-withdrawal disbursement requirements for Title IV funds were not followed. In a non-statistical sample of 60 students for the Fall 2023 and Spring 2024 semesters, from a population of 456 students who received Title IV funding and ceased attendance or never began attendance, the following was noted: • For 16 students (27%), SUBR did not perform a return of Title IV funds calculation because the students were incorrectly identified as enrolled rather than unofficially withdrawn, which resulted in $39,183 of Title IV funds not being returned to the USDOE. • For two students (3%), SUBR used incorrect withdrawal dates in the return of Title IV calculation, which resulted in one of the students requiring a Title IV return of $372. • For three students (5%), SUBR did not follow the requirements for post-withdrawal disbursements of grant funds by not providing timely notification of the post-withdrawal disbursement to the student or parent. Criteria: 34 CFR 668.22(a)(1) requires the institution to determine the amount of Title IV funds that the student earned as of the student’s withdrawal date. 34 CFR 668.22(e)(4) requires the institution to calculate the amount of unearned Title IV assistance to be returned. 34 CFR 668.22(j) requires the institution to return unearned Title IV funds within 45 days of the determination date of withdrawal, and to determine the date of withdrawal within 30 days after the end of the period of enrollment. Per 34 CFR 668.22(a)(6)(iii)(A), for post withdrawal disbursements, a written notification must be provided to the student or parent within 30 days of the date of the institution’s determination that the student withdrew. 34 CFR 668.22(e)(2) the percentage of Title IV funds earned by the student is equal to the percentage of the period of enrollment that the student completed if this date occurs on or before completion of 60 percent of the period of enrollment. Cause: SUBR did not follow its procedures to unofficially withdraw students who stopped attending classes prior to completing 60% of the semester. Also, instructors entered conflicting information for students’ final grade and/or students’ last day of attendance. In addition, federal guidelines were not followed when making a post withdrawal disbursement. Effect: Failure to return Title IV funds, prepare accurate calculations, and follow requirements related to post withdrawal disbursements resulted in noncompliance with federal regulations and increases the risk that federal funds will be required to be returned to the federal grantor. Audit procedures identified $39,555 that SUBR did not return to the USDOE, which are considered questioned costs. Recommendation: Management should strengthen controls to ensure that funds are returned timely to the USDOE, ensure that all return of Title IV funds calculations are performed accurately, and federal guidance for post withdrawal disbursements is followed. In addition, management should ensure instructors submit accurate grade and attendance information in order to determine a student’s correct enrollment status and last day of attendance. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-56).

2024-018 - Inadequate Internal Controls and Noncompliance with Cash Management Requirements State Entity: Southern University at Baton Rouge (SUBR) Award Year: 2024 Award Numbers: P063P231525, P268K241525 Compliance Requirement: Cash Management Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: SUBR did not comply with federal regulations regarding the timely return of excess Title IV funds. In our audit procedures for the fiscal year ended June 30, 2024, we noted SUBR overdrew $9.7 million in Federal Direct Student Loan funds on September 18, 2023, as the amount drawn exceeded what was needed for immediate loan disbursements to students. However, total Title IV funds were not overdrawn as there was also an under draw of the Federal Pell Grant Program (Pell). The overdraw on September 18, 2023, did not cause SUBR to have excess cash until Pell funds were drawn on September 29, 2023. Federal regulations consider an institution to have excess cash if those funds are not distributed within three business days of the draw. At the end of the third business day subsequent to the draw on September 29, 2023, SUBR had excess cash of approximately $2 million in Title IV funding. The excess cash was later detected by SUBR and refunded to the U.S. Department of Education (USDOE) on November 4, 2023; therefore, no questioned costs existed at fiscal year-end. Criteria: Per 34 CFR 668.162(b), under the advance payment method, an institution submits a request for funds to the USDOE. The institution’s request may not exceed the amount of funds the institution needs immediately for disbursements the institution has made or will make to eligible students and parents. Per 34 CFR 668.166(a), USDOE considers excess cash to be any amount of Title IV program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution received those funds from the USDOE. Cause: Due to a weakness in internal controls over drawdowns of Title IV funds, SUBR drew funds from Federal Direct Student Loans on September 18, 2023, but a portion of these funds should have been drawn from the Federal Pell Grant Program. Although SUBR has a reconciliation process, it is not suitably designed to timely detect overdraws for Title IV programs. Effect: Failure to implement sufficient controls over cash management requirements resulted in an overdraw of Title IV funds and noncompliance with cash management regulations. Recommendation: Management should strengthen its procedures over the drawing of Title IV funds to ensure timely compliance with federal cash management requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-58).

2024-019 - Noncompliance and Inadequate Controls over Direct Loan Monthly Reconciliations State Entity: University of Louisiana at Monroe (ULM) Award Year: 2024 Award Numbers: P268K241521, P268K251521 Compliance Requirement: Cash Management Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The University of Louisiana at Monroe (ULM) did not have adequate controls in place to ensure that monthly reconciliations for the Federal Direct Student Loans program were performed to meet the federal requirements. In addition, ULM did not have documented or verifiable policies and procedures for the reconciliation process. Each month, the U.S. Department of Education’s (USDOE) Common Origination and Disbursement (COD) system provides the institution the School Account Statement (SAS) data file, which must be used to reconcile the institution’s financial records to ensure the institution has transmitted accurate and complete student data to the COD system for all Federal Direct Student Loans borrowers in accordance with federal regulations. In a non-statistical sample of two monthly Direct Loan reconciliations, we found that for both months selected: • ULM did not utilize the SAS to reconcile all Direct Loan funds received and disbursed as recorded by USDOE systems to ULM’s internal records. • Monthly reconciliations did not include sufficient support identifying discrepancies and/or resolution. • Reconciliations did not identify any remaining cash balances or justification for such. • ULM could not provide evidence of review for their monthly reconciliations. Criteria: 34 CFR 685.300(b)(5) requires that schools must, on a monthly basis, reconcile institutional records with Federal Direct Student Loans funds received and disbursement records submitted to and accepted by USDOE. The 2023 - 2024 Federal Student Financial Aid Handbook (Vol. 4, Ch. 6) notes that a school that participates in the Federal Direct Student Loans Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the COD system monthly. A school is considered to have completed its monthly reconciliation when all differences between the Direct Loan SAS and the school’s internal records have been resolved or documented and the school’s ending cash balance is zero. In addition, schools should clearly outline their reconciliation process and documentation requirements in their policies and procedures. Cause: ULM did not have documented or verifiable policies and procedures for the reconciliation process. Effect: Failure to properly perform and document the required monthly Direct Loan reconciliations could result in undetected discrepancies between the institution’s financial records and data in the COD system which could result in cash overdraws. Recommendation: Management should develop adequate internal controls, including documenting policies and procedures to ensure accurate preparation, documentation, and review of Direct Loan monthly reconciliations as required by the federal grantor. Management’s Response and Corrective Action Plan: Management acknowledged the issues noted in the finding and provided a corrective action plan (B-66).

2024-020 – Control Weakness over Social Services Block Grant Expenditures State Entity: Department of Children and Family Services (DCFS) Award Year: 2024 Award Number: 2401LASOSR Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Department of Children and Family Services (DCFS) did not have adequate controls in place to ensure that expenditures charged to the Social Services Block Grant (SSBG) federal program through their Tracking Information Payment System (TIPS) were supported and approved. In a statistical sample of 40 expenditures out of a population of 64,711 expenditure transactions totaling $17,347,798, we noted the following deviations: • For one (3%) transaction, DCFS was unable to provide the TIPS payment form, which shows evidence of review and approval for the payment detail. However, DCFS did provide the invoice, which included payment detail information to support allowability of the expenditure. • For one (3%) transaction, the TIPS payment form lacked evidence of review and approval as it was not signed by a supervisor. Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Cause: Management represented that the cause for these deviations is due to a shortage of staffing in positions that prepare and process these TIPS forms. Effect: Failure to maintain adequate controls increases the risk that errors and omissions may occur and remain undetected. Recommendation: Management should strengthen internal controls to ensure that SSBG expenditures maintained in TIPS are supported and approved. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-3).

2024-021 – Unauthorized Employee Fuel Transactions State Entity: Department of Children and Family Services (DCFS) Award Years: 2023, 2024 Award Numbers: 2301LAFOST, 2301LASOSR, 2401LAFOST Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The DCFS Bureau of Audit and Compliance Services investigated and identified multiple instances of unauthorized fuel transactions made by a former DCFS employee of approximately $97,500 in fiscal year 2024. Of that total, $5,191 was charged to the Social Services Block Grant federal program and $32,555 was charged to the Foster Care federal program through the cost allocation process. Criteria: DCFS policy and procedures require each DCFS office to have a Fleet or Safety Coordinator responsible for overseeing the FuelTrac account. DCFS Policy 1-15 also requires each office to establish internal management procedures and guidelines for handling state vehicles. 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: The misappropriation occurred because DCFS did not have adequate controls in place to timely detect or prevent the employee from making and concealing unauthorized fuel transactions. Effect: As of March 31, 2024, the employee being investigated resigned. Inadequate controls over FuelTrac increases the risk that inappropriate transactions could occur and unallowable costs could be charged to federal programs. The total identified federal questioned cost in fiscal year 2024 due to this misappropriation is $37,746. Recommendation: DCFS should establish policies and procedures at an appropriate level to ensure fuel transactions are properly monitored and that duties are properly segregated. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-4).

2024-022 - Inadequate Controls over and Noncompliance with Matching and Reporting Requirements Related to the Cost Share Process State Entity: Louisiana Department of Health (LDH) Award Year: 2024 Award Number: 2405LA5MAP Compliance Requirements: Matching, Level of Effort, Earmarking; Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Louisiana Department of Health (LDH) did not have adequate controls in place to ensure the Federal Medical Assistance Percentage (FMAP) was appropriately updated in the cost share tables within LaGov for two out of four quarters (50%) in fiscal year ending June 30, 2024 for the Medical Assistance Program (Medicaid). The FMAP rate in the cost share tables was 1.5% higher than the rates established in the Federal Register for the quarters ending March 31, 2024 and June 30, 2024. Criteria: The state is required to pay part of the costs of providing Medicaid services and part of the costs of administering the program. The percentage of federal funding is determined based on the amount of the expenditures and application of the FMAP that is determined for each state using a formula outlined in section 1905(b) of the Act (42 USC 1396d). 2 CFR 200.306(b) states that the basic criteria for acceptable matching include that the funds are verifiable from the non-federal entity’s records, are not included as contributions for any other federal award, and are not paid by the federal government under another federal award. The CMS-64 quarterly federal expenditure report requires the state to certify that the required amount of state and/or local funds were available and used to match the state’s allowable expenditures included in the report, and such state and/or local funds were in accordance with all applicable federal requirements for the non-federal share match of expenditures. The CMS-64 report also requires the state to certify that the expenditures included in the report are based on the state's accounting of actual recorded expenditures. Cause: The cost share tables that automatically calculate the federal and state share of expenditures were not properly updated for the period January 1, 2024 through June 30, 2024. Effect: Using the incorrect FMAP to allocate the state share of expenditures caused more expenditures to be allocated to federal funds. This error resulted in federal questioned costs of $87,591,863. Due to this, LDH was unable to provide evidence that the state match requirement was met for the federal expenditures reported on the March 31, 2024 and June 30, 2024 CMS-64 federal expenditure reports. Recommendation: LDH management should ensure the cost share tables are appropriately updated for all periods during the fiscal year. In addition, LDH should strengthen controls over preparation and review of the quarterly CMS-64 federal expenditure reports to ensure that the appropriate federal match is applied to qualifying expenditures and the required amount of state and/or local funds are available and used to match the state’s allowable expenditures. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-10).

2024-023 - Inadequate Controls over Billing for Behavioral Health Services State Entity: Louisiana Department of Health (LDH) Award Years: 2023, 2024 Award Numbers: 2305LA5021, 2305LA5MAP, 2405LA5021, 2405LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2023-021) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the sixth consecutive year, LDH, the managed care organizations (MCOs), and Magellan Health Services (Magellan) did not have adequate controls in place to ensure that behavioral health services in the Medical Assistance Program and Children’s Health Insurance Program were properly billed and that improper encounters were denied. For fiscal year 2024, we identified approximately $14.4 million in encounters for services between July 1, 2023, and June 30, 2024, that were paid by the MCOs and Magellan even though the encounters do not appear to comply with LDH’s encounter coding requirements and/or approved fee schedules. Our analysis identified the following instances of billing errors. Providers were paid $11,075,376 for 166,209 encounters that were billed using incorrect procedure and modifier codes. Providers were paid $3,306,206 for 32,987 encounters that exceeded LDH’s specialized behavioral health services fee schedules. Criteria: LDH’s fee schedule outlines procedure codes for services and the applicable billing rates. Some services require that procedure codes also contain modifier codes which indicate information such as the age of the recipient, location where the service was provided, the educational background of the person providing the service, and the license(s) they have obtained. The approved fee schedules outline different rates depending on the procedure code and modifier codes. The MCOs can optionally pay more than the minimum LDH fee schedule. Cause: In following its corrective action plan from fiscal year 2022, LDH contracted with the External Quality Reviewer (EQR) to validate a representative sample of encounters against the Medicaid fee schedule on file at the time of service delivery, inclusive of modifier utilization. Implementation of this protocol began in fiscal year 2023 and has continued through fiscal year 2024. However, auditors noted that for the second year in a row the EQR’s analysis did not review the use of location modifiers in encounters and did not exclude encounters from providers that were approved by MCO’s to bill in excess of the fee schedule. The billing errors could be avoided by LDH, the MCOs, and Magellan applying system edits that would flag encounters for further review when encounter coding and/or fee schedule requirements are not followed. Effect: Without the required modifiers, the encounter does not contain enough information to determine that the billing was appropriate. Because LDH does not currently maintain a list of these providers in which the MCO pays more than the minimum fee schedule, LDH cannot determine if an encounter paid at an excessive rate was improperly billed. It is important that encounter data is accurate because LDH and other stakeholders, such as the Medicaid Fraud Control Unit within the Attorney General’s Office, use this data to identify improper payments and potential fraud. LDH also uses this encounter data to establish per member per month rates for the MCOs. Recommendation: LDH management should ensure that agency personnel are adequately monitoring the EQR contract and that the proper validations are being conducted to ensure encounters are coded correctly. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-14).

2024-024 - Inadequate Controls over Reporting and Matching Federal Compliance Requirements for the Medicaid and Children's Health Insurance Programs State Entity: Louisiana Department of Health (LDH) Award Years: 2023, 2024 Award Numbers: 2305LA5021, 2305LA5MAP, 2405LA5021, 2405LA5MAP Compliance Requirement: Matching, Level of Effort, Earmarking; Reporting Repeat Finding: Yes (Prior Year Finding No. 2023-022) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the second consecutive year, LDH did not have adequate controls in place to ensure compliance with reporting and matching requirements for the Medical Assistance Program (Medicaid) and the Children’s Health Insurance Program (CHIP) for all four quarters of fiscal year 2024. The following errors were noted throughout the Centers for Medicare and Medicaid Services (CMS) quarterly federal expenditure reports prepared by LDH: • For each quarter of fiscal year 2024, quarterly adjustment expenditures were either incorrectly recorded on the CMS quarterly federal expenditure reports and/or within the financial statements. • For both the March 31, 2024 and June 30, 2024 reports LDH incorrectly completed the Medicaid Drug Rebate Schedule 64.9R. For the March 31, 2024 report, an invoice amount of $0 was reported as the rebates invoiced in this quarter rather than the correct amount of $243,910,667. For the June 30, 2024 report, LDH incorrectly adjusted the schedule 64.9R resulting in numerous errors and a net understatement of $220,130,454 in an effort to correct the error from the March 31, 2024 report. • LDH incorrectly overstated federal fiscal year 2023 Disproportionate State Hospital (DSH) payments by $820,395 on schedule 64.9D for the September 30, 2023 report. Criteria: According to 2 CFR 200.302(b)(2), accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements set forth in §200.328 and §200.329 is required. The Medicaid and CHIP programs require quarterly reporting to CMS detailing expenditures by category of service for which states are entitled to federal reimbursement. The federal expenditures reported in the quarterly reports are used to reconcile the draws of federal funds. In addition, a good system of internal controls require that policies and procedures are established and followed to ensure compliance with federal requirements. Cause: LDH did not have adequate controls in place to ensure the reconciliation of the expenditures recorded in LDH’s financial statements to the expenditures reported to CMS. In addition, the quarterly adjustments were not properly reviewed to ensure that adjustments affecting the financial statements were properly recorded. Effect: As a result, LDH failed to detect multiple errors between the financial statements and CMS quarterly federal expenditure reports, as well as errors on various schedules in the quarterly reports. Uncorrected errors in the reports increase the risk that federal funds will be overdrawn or underdrawn and place LDH in noncompliance with federal regulations. Recommendation: LDH management should strengthen controls over preparation and review of the quarterly federal expenditure reports and quarterly adjustments to ensure federal expenditures are accurately reported. In addition, LDH management should incorporate a reconciliation of federal expenditures in the financial statements to federal expenditures reported to CMS. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-17).

2024-025 - Inadequate Controls over Waiver and Support Coordination Service Providers State Entity: Louisiana Department of Health (LDH) Award Years: 2023, 2024 Award Numbers: 2305LA5MAP, 2405LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2023-023) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the second consecutive year, LDH paid Medicaid Home and Community Based Services (HCBS) claims for the New Opportunities Waiver (NOW) for waiver services that were not adequately documented. In addition, payments were made for the Residential Options Waiver (ROW) for waiver services that were not adequately documented. LDH also paid claims for support coordination services that were not documented in accordance with established policies. Our testing of NOW and ROW waiver services included 729 claims paid in state fiscal year 2024 totaling $130,881 paid to two providers for 14 beneficiaries. Our test identified errors for 501 claims totaling $16,634 in federal funds, with some claims having multiple errors. The following errors were noted. • For 383 claims for 13 beneficiaries, the waiver services provider did not provide adequate documentation to support billed services. • For 121 claims for 9 beneficiaries, the waiver services provider did not provide documentation substantiating the reasons for departures from the approved plan of care (POC). • For 50 claims for 3 beneficiaries, the waiver services provider billed the units of service for the claim at a rate that was inconsistent with the allocated billing rate per unit in the POC. • For 4 claims for 1 beneficiary, the waiver services provider inappropriately billed for services that overlapped with non-waiver institutional services. In addition to testing NOW and ROW waiver services, we also tested claims paid for support coordination services for the 14 waiver beneficiaries tested. In our test of 156 claims paid in fiscal year 2024 totaling $30,544 paid to six support coordination providers for the 14 beneficiaries, the support coordination service provider did not provide adequate documentation to support billed services for six claims for two beneficiaries. The federally funded portion of these claims totaled $768. Criteria: 42 CFR Part 441, Subpart G requires states to operate their HCBS programs with certain assurances, including health and welfare, financial accountability, and evaluation of need. To meet these assurances, states must demonstrate that they have systems to effectively monitor the adequacy of service plans, the qualifications of providers, and the health and welfare of beneficiaries. Waiver services are accessed through support coordinators who assist with development and monitoring of the beneficiary’s POC. Auditors used LDH’s provider manuals to identify required documentation, which includes billing codes, an approved POC, time sheets or electronic clock in/out and progress notes. Provider manuals are intended to give a provider the information needed to fulfill its vendor agreement with the State of Louisiana, and is the basis for federal and state reviews of the program. The beneficiary’s case record is required to include a copy of the approved POC, including any revisions. The POC documents the beneficiary’s assessed needs and types and quantity of services to address those needs and costs related to services. Direct service providers provide care to a beneficiary based on the approved POC. According to the LDH service coordination provider manual, service logs are the means for clearly documenting services billed and must be reviewed by supervisors. In addition, in accordance with 42 CFR 441.301(b)(1)(ii), waiver services are not furnished to individuals who are inpatients of a hospital, nursing facility or inpatient care facility for individuals with an intellectual disability. Cause: The errors noted in testing occurred because LDH failed to adequately monitor that NOW and ROW waiver and support coordination providers properly maintained adequate records, supporting documentation, and appropriately billed for services. Effect: Without adequate documentation a provider cannot substantiate and auditors cannot verify that the departures were beneficiary-driven and person-centered as required. Without adequate supporting documentation there is reduced assurance that billed services were properly billed, were actually performed, beneficiaries are receiving needed services, and limited resources are allocated appropriately. Questioned costs totaling $17,402 in federal funds were noted in relation to the waiver services provider and support coordination services provider not providing adequate documentation to support billed services. Recommendation: LDH should ensure all departmental policies and federal regulations for waiver and support coordination services are enforced, including documentation to support claims and evidence that departures from the approved POC meet the needs of the beneficiary. LDH should consider additional provider training regarding documentation requirements. Management’s Response and Corrective Action Plan: Management partially concurred with the finding stating they did not concur with three of the errors noted in the determination of inadequate controls. For the error that management concurred with, a corrective action plan was provided (B-19). Auditor’s Additional Comments: LDH noted in their response they did not concur with three of the errors noted in the determination of inadequate controls over waiver and support coordination providers and have concerns with LLA’s overreliance on documentation in determining control adequacy. According to CFR 200.303(a) the recipient must establish, document, and maintain effective internal control over federal awards that provides reasonable assurance that the recipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. As part of obtaining reasonable assurance that the system of internal control is operating effectively and implemented, documentation supporting these controls is necessary for the auditor to make these determinations. All control mechanisms that were in place, documented, and provided to the auditor were considered. In addition, LDH noted that there was no error in the departures from the approved POC nor were there errors associated with the claims that were reported as having been billed at the incorrect rate. As stated in the finding, documentation could not be provided to substantiate the reason for the departure from the approved POC for either the number of units or the allocated billing rate per unit. Finally, LDH noted that while claims were paid for waiver services that overlapped with non-waiver institutional services, there was no error as LDH’s established controls identified and addressed the overlap in billing. The exceptions noted for these claims were a result of LDH not providing sufficient supporting documentation to the auditor showing the recoupment of the payments for the overlapping shifts.

2024-026 - Inadequate Internal Controls over Eligibility Determinations State Entity: Louisiana Department of Health (LDH) Award Years: 2022, 2023, 2024 Award Numbers: 2205LA5MAP, 2305LA5021, 2305LA5MAP, 2405LA5021, 2405LA5MAP Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2023-024) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the fifth consecutive year, LDH lacked adequate internal controls over eligibility determinations in the Medical Assistance Program (Medicaid) and Children’s Health Insurance Program (CHIP) programs for the fiscal year ended June 30, 2024. From a population of 73,333,570 Medicaid Per-Member-Per-Month (PMPM) and Fee-For-Service (FFS) payments totaling $13.3 billion, a non-statistical sample of 60 Medicaid payments were selected and the corresponding beneficiary’s eligibility was tested to ensure compliance with eligibility federal regulations. Discrepancies related to the beneficiary’s case records regarding eligibility determination and redetermination were identified for nineteen (31.67%) out of 60 payments tested. The following errors were noted for Medicaid: • For four payments, inadequate or incorrect documentation was included in the case record to support the eligibility determination or redetermination. • For 11 payments, LDH personnel did not accurately perform all required eligibility determinations before renewing the beneficiary. • For two payments, LDH did not follow policies to discontinue coverage at the end of the COVID -19 public health emergency for beneficiaries whose citizenship status remained unverified at the end of their reasonable opportunity period. These beneficiaries were therefore not validly enrolled during fiscal year 2024. • For one payment, LDH failed to continue coverage on a beneficiary who had been determined eligible at renewal, causing a one-month lapse in coverage. • For one payment, LDH personnel failed to verify Louisiana residency for the initial application on a beneficiary who resided out of state. The beneficiary’s application listed an out of state address in a border city. LDH failed to review the address to verify the exact state of residence, which would have resulted in a denial of coverage. Therefore, the beneficiary was not validly enrolled at initial application in fiscal year 2022. In addition, from a population of 6,646,797 CHIP PMPM and FFS payments totaling $538 million, a non-statistical sample of 60 CHIP payments were selected and the corresponding beneficiary’s eligibility was tested to ensure compliance with eligibility federal regulations. Discrepancies related to the beneficiary’s case records regarding eligibility determination and redetermination were identified for eleven (18.33%) out of 60 payments tested. The following errors were noted for CHIP: • For two payments, inadequate or incorrect documentation was included in the case record to support the eligibility determination or redetermination. • For five payments, issues in the Louisiana Medicaid Eligibility Determination System resulted in inadequate documentation within the case record to support the eligibility redetermination for the beneficiary. • For three payments, LDH personnel did not accurately perform all required eligibility determinations before renewing the beneficiary. • For one payment, LDH personnel failed to accurately perform all required eligibility determinations before enrolling the beneficiary, therefore the beneficiary was invalidly enrolled when they initially applied for eligibility in fiscal year 2023. Criteria: 42 CFR 431, 42 CFR 435, and 42 CFR 457 require that in order to be considered eligible, a beneficiary must meet all eligibility factors and the beneficiary’s case record must include facts to support the agency’s eligibility decision. 42 CFR 435 and 457 also require annual renewal of eligibility. LDH has outlined eligibility criteria and documentation to support determinations and renewals in its Medicaid Eligibility Manual. Cause: LDH did not adhere to established control procedures to ensure case records support eligibility determination and redeterminations per the federal regulations and the Medicaid Eligibility Manual. Effect: Proper eligibility determination and redetermination are critical to ensuring appropriate service eligibility, appropriate premium payments, and appropriate federal match rate on expenditures. Questioned costs totaling $28,793 in federal funds were noted in relation to the Medicaid beneficiaries who were invalidly enrolled or whose renewal determination resulted in an erroneous certification of eligibility. Questioned costs totaling $6,042 in federal funds were noted in relation to the CHIP beneficiary who was invalidly enrolled. We did not note any questioned costs related to the other errors. Recommendation: LDH should ensure its employees follow procedures and federal regulations relating to eligibility determinations and redeterminations in the Medicaid and CHIP programs to ensure the case records support the eligibility decisions. Management’s Response and Corrective Action Plan: Management partially concurred with the finding stating they did not concur with one Medicaid and six CHIP errors noted within the finding. For those errors that management concurred with, a corrective action plan was provided (B-24). Auditor’s Additional Comments: LDH noted in their response they did not concur with the errors noted for the Medicaid and CHIP renewals related to SNAP or express lane eligibility not being properly documented and indicated that system logs were provided. The LaMEDS log tables were considered by the auditor and no errors in the eligibility determination were reported. The errors noted in the finding relate to a weakness in internal controls as the system bug noted in the case record produced inadequate documentation. In addition, LDH stated in their response they did not concur with one CHIP finding for inadequate documentation regarding income to support the renewal determination. The error noted by the auditor did not relate specifically to the missing affidavit, but that sufficient support was not obtained by LDH to support the change in income from the application.

2024-027 - Noncompliance with and Inadequate Controls over Maternity Kick Payments State Entity: Louisiana Department of Health (LDH) Award Years: 2023, 2024 Award Numbers: 2305LA5021, 2305LA5MAP, 2405LA5021, 2405LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2023-025) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the second consecutive year, LDH did not adhere to established policies and procedures regarding maternity kick payments for fiscal year 2024. Maternity kick payments are one-time payments made by LDH to reimburse the Healthy Louisiana Managed Care Organizations (MCOs) for the costs associated with pre- and post-partum maternal care, as well as the delivery event itself. These payments are paid to an MCO upon submission of satisfactory evidence of the event or treatment which is referred to as a triggering event. During the period July 1, 2023, through June 30, 2024, LDH paid out 30,004 Medical Assistance Program (Medicaid) maternity kick payments totaling $307 million of state and federal funds to the Healthy Louisiana MCOs. In our review of all Medicaid maternity kick payments, we identified 21 kick payments totaling $146,584 in federal funds that were paid to the Healthy Louisiana MCOs based on an ineligible triggering event. During the period July 1, 2023, through June 30, 2024, LDH paid out 4,672 Children’s Health Insurance Program (CHIP) maternity kick payments totaling $47.7 million of state and federal funds to the Healthy Louisiana MCOs. In our review of all CHIP maternity kick payments, we identified three kick payments totaling $26,218 in federal funds that were paid to the Healthy Louisiana MCOs based on an ineligible triggering event. Criteria: Louisiana Administrative Code (LAC) Title 50, Part I, Section 3509(A)(5) states MCOs may be reimbursed a one-time supplemental lump sum payment, referred to as a kick payment. The kick payment is intended to cover the cost of a specific care event or treatment. Payment will be made to the MCO upon submission of satisfactory evidence of the event or treatment under Title XIX to the Social Security Act. In accordance with this guidance, LDH policies require an eligible triggering event to occur before a maternity kick payment can be made. LDH procedures also require that a review of kick payments be performed semi-annually. Cause: LDH did not adhere to the established policies and procedures regarding maternity kick payments and their reviews in FY 2024 failed to notate the coding error that allowed kick payments to be paid for ineligible triggering events. Effect: There is an increased risk that maternity kick payments are being paid to Healthy Louisiana MCOs for triggering events that may not have taken place or do not have satisfactory supporting evidence. Recommendation: LDH should strengthen existing policies and procedures to ensure all maternity kick payments are supported with an eligible triggering event before payment is made to the MCOs. Management’s Response and Corrective Action Plan: Management did not concur with the finding stating corrective action is not necessary, as recoveries were identified and processed as part of the regularly scheduled review process; however, LDH will modify the timing of its final quarterly reviews to ensure that payment/voids in June do not result in a finding (B-26). Auditor’s Additional Comments: As part of LDH’s procedures over maternity kick payments, LDH has an approved set logic in their claims processing system to pay maternity kick payments to MCOs when an eligible triggering event occurs. As LDH noted in their finding response, the errors noted in the finding were due to an error in this logic. While the logic error was discovered in their September 2024 review, adequate internal controls should be in place and operating effectively to ensure the logic is accurate at the time it is applied to transactions. In addition, recovery from the MCO also does not constitute the return of federal funds. While the MCO may have returned the funds to LDH, the funds must then be returned to the federal government on the next quarterly CMS 64 report. LDH did not provide evidence of this return.

2024-028 - Noncompliance with Disproportionate Share Hospital Payments State Entity: Louisiana Department of Health (LDH) Award Year: 2024 Award Number: 2405LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: LDH exceeded the federally allocated 2016 Disproportionate Share Hospital (DSH) funding limit by $4,225,716. LDH makes payments to qualifying hospitals that serve a large number of Medical Assistance Program (Medicaid) and uninsured individuals for uncompensated costs. These payments are known as DSH payments. Criteria: Section 1923 of the Social Security Act and LDH's State Plan Amendment 4.19 limits DSH payments on a state-wide basis to the annual DSH allotment. The allotment is capped and represents the maximum federal matching payments a state is permitted to claim. The allotment does not have to be spent in the specific allotment year but can be applied indefinitely until completely utilized. Cause: The overage occurred due to an inadequate reconciliation between the agency’s actual DSH expenditures and the federal allotment. LDH failed to adequately update their tracking spreadsheet to include all 2016 DSH federal allotment payments that had previously been claimed and federally reimbursed. Effect: The 2016 DSH funding limit was exceeded and resulted in $4,225,716 in questioned costs. Recommendation: LDH should ensure an adequate review of the tracking spreadsheet to verify that all federal payments are included and to prevent the department from exceeding the federal DSH allotment in the future. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-28).

2024-029 - Noncompliance with Managed Care Provider Enrollment and Screening Requirement State Entity: Louisiana Department of Health (LDH) Award Years: 2023, 2024 Award Numbers: 2305LA5021, 2305LA5MAP, 2405LA5021, 2405LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2023-026) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the seventh consecutive year, LDH did not enroll and screen all Healthy Louisiana managed care providers and dental managed care providers as required by federal regulations. In our review of the 23,170 providers paid during fiscal year 2024, it was determined that 8,209 (35%) of managed care and dental managed care providers were not enrolled and screened in accordance with federal regulations. Criteria: 42 CFR 438.602 (2016 Managed Care Final Rule) and Section 5005 of the 21st Century Cures Act require that the enrollment process include providing the Medical Assistance Program (Medicaid) agency with the provider’s identifying information including the name, specialty, date of birth, Social Security number, national provider identifier, federal taxpayer identification number, and state license or certification number of the provider. Additionally, the state agency is required to screen enrolled providers, require certain disclosures, provide enhanced oversight of certain providers, and comply with reporting of adverse provider actions and provider terminations. By using the federally required process, managed care providers must participate in the same screening and enrollment process as Medicaid and Children’s Health Insurance Program (CHIP) fee-for-service providers. Cause: In July 2021, LDH launched the enrollment portal created by Gainwell, the state’s current provider enrollment vendor. Although the enrollment portal launched in fiscal year 2022 for existing providers as of March of 2022, new providers were not invited to enroll as this required an amendment to the contract with Gainwell and additional costs. Therefore, not all of the Healthy Louisiana managed care providers and dental managed care providers that received payments in fiscal year 2024 were enrolled and screened. Effect: LDH cannot ensure the accuracy of provider information obtained from the Louisiana Medicaid managed care plans and cannot ensure compliance with enrollment requirements defined by law and the Medicaid and CHIP state plan. Recommendation: LDH should ensure all providers are screened and enrolled as required by federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-30).

2024-030 - Noncompliance with Medicaid Federal Matching and Reporting Requirements Related to a Means of Financing Reallocation State Entity: Louisiana Department of Health (LDH) Award Year: 2024 Award Number: 2405LA5MAP Compliance Requirements: Matching, Level of Effort, Earmarking; Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: LDH did not have evidence that the state share of Medical Assistance Program (Medicaid) expenditures associated with $248,367,729 of federal expenditures reported on the June 30, 2024 CMS-64 quarterly federal expenditure report were expended using state funds as of the date of the report. Criteria: The state is required to pay part of the costs of providing Medicaid services and part of the costs of administering the program. The percentage of federal funding is determined based on the amount of the expenditures and the application of the Federal Medical Assistance Percentage that is determined for each state using a formula outlined in section 1905(b) of the Act (42 USC 1396d). 2 CFR 200.306(b) states that the basic criteria for acceptable matching include that the funds are verifiable from the non-federal entity’s records, are not included as contributions for any other federal award, and are not paid by the federal government under another federal award. The CMS-64 quarterly federal expenditure report requires the state to certify that the required amount of state and/or local funds were available and used to match the state’s allowable expenditures included in the report, and such state and/or local funds were in accordance with all applicable federal requirements for the non-federal share match of expenditures. The CMS-64 report also requires the state to certify that the expenditures included in the report are based on the state's accounting of actual recorded expenditures. Cause: LDH reallocated the means of financing for Medicaid expenditures totaling $118,660,095 from being funded by state funds to federal carryforward funds as of June 30, 2024. As a result, the expenditures were no longer considered eligible state match expenditures, and therefore, the total amount of the Medicaid expenditures (total computable which includes both state and federal shares - $367,027,824) associated with the $118,660,095 should have been excluded from the June 30, 2024 CMS-64 report. However, when LDH prepared the June 30, 2024 CMS-64 report, they only removed the $118,660,095 from the total computable amount. Effect: By not removing the full $367,027,824, LDH reported $248,367,729 in Medicaid expenditures on the CMS-64 report that they were unable to provide evidence that the state share of expenditures were funded with allowable sources, resulting in federal questioned costs of $168,070,442. The certifications attested to by LDH in the CMS-64 report upon submission to CMS were no longer accurate. Recommendation: LDH management should strengthen the system of internal controls over preparation and review of the quarterly CMS-64 reports to ensure expenditures are accurately reported and that the required amount of state and/or local funds are available and used to match the state’s allowable expenditures. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-32).

2024-031 - Weakness in Controls over and Noncompliance with Provider Overpayments State Entity: Louisiana Department of Health (LDH) Award Years: 2023, 2024 Award Numbers: 2305LA5021, 2305LA5MAP, 2405LA5021, 2405LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2023-027) See Schedule of Findings and Questioned Costs for chart/table. Condition: For the second consecutive year, LDH did not have adequate controls in place to correctly identify the date of discovery for provider overpayments. From a population of 77,634 transactions totaling $147.1 million, a non-statistical sample of 59 provider overpayments was selected and tested to determine if LDH complied with the federal regulations regarding the refunding of the federal share of provider overpayments. For one (1.69%) out of 59 provider overpayments selected for testing, there was no supporting documentation available to identify the date of discovery. Therefore, the auditor was unable to ensure the federal share of the overpayment was returned timely. In addition, LDH did not provide evidence that an adequate review was performed for three out of the four (75%) quarterly CMS-64 Line 9 reconciliations. These reviews ensure provider overpayments are reported timely and on the correct line of the CMS-64 federal expenditure quarterly report. Criteria: Pursuant to 1903(d)(2)(c) of the Act (42 USC 1396b), states have up to one year from the date of discovery of the overpayment to recover or attempt to recover the overpayment from the provider before the federal share must be refunded to CMS via the CMS federal expenditure quarterly report, regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier. According to 42 CFR Part 433.316(c), the date of discovery is the earliest of the date on which any Medicaid agency official or other state office first notifies a provider in writing of an overpayment, the date on which a provider initially acknowledges a specific overpaid amount in writing to the Medicaid agency, or the date on which any state office or fiscal agent of the state initiates a formal action to recoup a specific overpaid amount from a provider without having first notified the provider in writing. In addition, good internal controls require that policies and procedures are established and followed to ensure compliance with federal requirements. Cause: In December of 2023, as part of their corrective action plan from fiscal year 2023, LDH updated their policy to require the submitting department/agency to specifically identify the date of discovery when providing provider overpayment information to LDH. Although implementation of the new policy began in fiscal year 2024, the policy was not in effect for 6 months out of the year. In addition, LDH did not ensure controls over provider overpayments were in place and properly monitored for every quarter during fiscal year 2024. Effect: By not appropriately identifying the date of discovery as defined by federal regulations, LDH cannot ensure that the federal share of provider overpayments that reach their one-year period are returned to CMS in the appropriate quarter. Recommendation: LDH should strengthen internal controls to ensure compliance with federal regulations regarding the timely return of the federal share of provider overpayment collections. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-34).

2024-032 - Inadequate Controls over and Noncompliance with Federal Financial Reporting State Entity: Louisiana Department of Health - Office of Public Health (OPH) Award Year: 2024 Award Number: NU90TP922016 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Louisiana Department of Health - Office of Public Health (OPH) did not have adequate controls in place to ensure that federal financial reports were accurate, current, and complete prior to being submitted to the federal agency for the Public Health Emergency Preparedness federal program for the June 30, 2024 reporting period. OPH's annual report for the reporting period June 30, 2024 improperly included expenditures totaling $146,598 from the period July 2024 through September 2024. Criteria: 2 CFR 200.302(b)(2) states accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements set forth in 2 CFR 200.328 and 200.329 is required. In addition, the U.S. Centers for Disease Control and Prevention guidance indicates that the report must include only those funds authorized and expended during the timeframe of the report. 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: OPH did not have adequate controls in place to ensure the federal financial report only included expenditures for the period being reported prior to submission to the federal agency. Effect: Failure to establish adequate controls over financial reporting could result in inaccurate information being reported to the federal agency. Recommendation: OPH should design and implement controls to ensure all information contained in the financial reports submitted to federal agencies is accurate, current, and complete for the reporting period covered under the report. Management’s Response and Corrective Action Plan: Management did not concur with the finding stating that the amount in question is immaterial and does not misstate the federal financial report. To address the control weakness, management provided a corrective action plan (B-36).

2024-033 - Noncompliance with and Inadequate Controls over Subrecipient Monitoring Requirements at Pennington Biomedical Research Center State Entity: Louisiana State University and Related Campuses Award Years: 2021, 2022, 2023 Award Numbers: 1P50MD017338-01, 1R01DK132011-01A1, 1U01AG073204-01, 1U01CA271279-01 Compliance Requirement: Subrecipient Monitoring Pass-Through Entity: University of Alabama at Birmingham Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: The Pennington Biomedical Research Center (PBRC) did not adequately monitor subrecipients of the Research and Development (R&D) Cluster programs. In a non-statistical sample of nine grants to subrecipients, out of a population of 61 grants, it was noted that for five (56%) of the grants evaluated, PBRC could not provide evidence that the required risk analyses were performed to evaluate the subrecipient’s fraud risk and risk of noncompliance with the subaward agreement. Criteria: 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient’s fraud risk and risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. Cause: PBRC did not follow established controls to ensure that R&D Cluster award subrecipients were monitored in accordance with federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal grantor. Recommendation: PBRC should strengthen controls to ensure risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-38).

2024-034 - Misappropriation of Research and Development Cluster Funds State Entity: Louisiana Tech University (La Tech) Award Year: 2024 Award Numbers: GR301449, GR301541 Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table. Condition: In December 2024, Louisiana Tech University (La Tech) discovered that during the period from February 2024 through November 2024, nine electronic fund transfer (EFT) payments to an out-of-state university totaling $206,451 had been fraudulently diverted to unknown person(s). La Tech reported the fraud to appropriate law enforcement and to the federal grantor. Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain internal control over the federal award that provides reasonable compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.403(a) indicates costs must be necessary and reasonable for the performance of the federal award. Cause: The misappropriation of funds occurred after an unknown individual(s) submitted fraudulent emails impersonating La Tech’s point of contact with the out-of-state university, requesting a change in payment method from physical check to EFT. La Tech processed the request under the incorrect assumption that it was legitimate. The stolen funds originated as grant funding (Research and Development Cluster) from the National Institutes of Health (NIH). La Tech became the direct recipient of the NIH grant funding when La Tech hired a faculty member that had been awarded the NIH grants while employed at the out-of-state university. Research related to the grant funding continued at the out-of-state university and La Tech, as the prime recipient, provided reimbursement. Effect: As a result of investigation, La Tech identified $206,451 in payments that were fraudulently diverted to unknown person(s). In response to this cyber fraud, La Tech management has represented that they are evaluating opportunities to further enhance its internal controls and verification procedures to better safeguard against increasingly sophisticated cyber threats targeting payment remittance processes. Recommendation: La Tech should continuously evaluate its internal controls to guard against future fraud attempts. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-49).

2024-035 – Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act State Entity: Governor’s Office of Homeland Security and Emergency Preparedness (GOHSEP) Award Years: 2008, 2016, 2021, 2022 Award Numbers: 1792-19, 4277-122, 4277-30, 4611-38, EMT-2022-FM-003 Compliance Requirement: Reporting Repeat Finding: Yes (Prior Year Finding No. 2023-031) See Schedule of Findings and Questioned Costs for chart/table. Condition: The Governor’s Office of Homeland Security and Emergency Preparedness (GOHSEP) did not fully comply with the Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Hazard Mitigation Grant (HM) and the Flood Mitigation Assistance (FMA) programs. This is the second consecutive year in which the FMA program was not compliant with FFATA reporting requirements. Our procedures disclosed the following: • In a non-statistical sample of 11 HM subawards tested totaling $15,127,069 from a population of 100 subawards totaling $76,083,506 made between July 1, 2023, and June 30, 2024, 4 subawards (36.4%) totaling $3,898,561 were submitted from 54 days to 117 days after the due date specified by federal regulations. • Of the 15 FMA subawards tested totaling $31,209,266, which was 100% of the subawards made between February 29, 2024, and June 30, 2024, 12 subawards (80%) totaling $21,245,124 were submitted from 115 days to 176 days after the due date specified by federal regulations. Criteria: 2 CFR Part 170 Appendix A(I)(a) requires the non-federal entity to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity into the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the obligation was made. Cause: GOHSEP does not have adequate internal controls to ensure compliance with FFATA reporting requirements. Effect: Noncompliance with FFATA reporting requirements prevents the public from having access to accurate and timely information regarding the administration of federal awards. Recommendation: GOHSEP should strengthen internal controls to ensure that appropriate personnel are timely entering the required award information for FFATA reporting in accordance with federal requirements. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-7). Management contends that the HM projects selected for the fiscal year 2024 audit were the same HM projects selected in the fiscal year 2023 audit and that the HM entries cited in this finding pre-date the agency’s corrective action. Management also stated that two of the FMA projects selected for the fiscal year 2024 audit were selected in the fiscal year 2023 audit and the remaining 10 projects in question were entered in calendar year 2024 as a part of the agency’s corrective action plan. Auditor’s Additional Comments: Submission of data into FSRS is required each time there is an additional obligation or amendment to a qualified project. Therefore, it is possible that a project was reviewed more than once if the project had multiple amendments during the audit period. The HM program at GOHSEP was not audited for fiscal year 2023, and as such, there was no duplication in items reviewed in the current audit. In addition, because HM is a major federal program for fiscal year 2024, federal guidance requires the auditor to review the agency’s compliance with federal requirements throughout the entirety of the year. The FMA obligations and/or amendments included in this finding occurred after February 2024, the date of management’s response to the prior year finding. Therefore, the current year finding does not include any FMA obligations or amendments that were previously reported. Also, the current year FMA obligations and amendments reviewed, although they may have been a part of management’s corrective action plan, were still submitted outside the required timeframe for reporting.

2023-003 - Control Weakness Related to Cost Allocation Process Award Years: 2018 - 2023 Award Numbers: 1804LADI00, 1904LADI00, 2004LADI00, 2104LADI00, 2201LACSES, 2201LAFOST, 2201LASOSR, 2204LADI00, 2301LACSES, 2301LAFOST, 2301LASOSR, 2304LADI00, SNAP - Letter of Credit Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Children and Family Services (DCFS) did not have adequate controls in place to ensure that expenditures were properly charged and allocated in accordance with the Cost Allocation Plan (CAP), which assigns costs to federal programs. In a statistical sample of 60 transactions out of a population of 241,344 expenditure transactions totaling $387,232,398 allocated to federal programs, two (3%) transactions had the following errors: • For one transaction, the supporting documentation was for a prior fiscal year, which resulted in incorrect percentages being charged to various cost pools affecting non-major federal programs. This error resulted in overbilling the Social Services Block Grant (SSBG) by $10,749 and underbilling Foster Care Title IV-E by $35,357. The amount overbilled to SSBG represents questioned costs. • For one transaction, the cost pool was not included in the CAP in error, and the amendment to the CAP was not submitted timely. Criteria: 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Per 2 CFR 200.400(d), the accounting practices of the non-federal entity must be consistent with cost principles and support the accumulation of costs as required and must provide for adequate documentation to support costs charged to the federal award. Per 45 CFR 95.509(a)(1) and (4), the state shall promptly amend the cost allocation plan and submit the amended plan to the Director, Division of Cost Allocation, if the following events occur: (1) The procedures shown in the existing cost allocation plan become outdated because of organizational changes, changes in federal law or regulations, or significant changes in program levels, affecting the validity of the approved cost allocation procedures. (4) Other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Cause: These errors occurred because there was not an effective review process in place and because the department did not ensure the timely correction of errors to the CAP. Effect: Failure to adequately review cost allocation supporting documentation and to ensure that changes are made to the cost allocation plan timely increases the risk that unallowable costs could be charged to federal programs. Recommendation: Management should strengthen internal controls over the review process and update the cost allocation plan for cost pool noted. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-3).

2023-004 – Improper Employee Activity in Federal Programs Award Years: 2020 - 2023 Award Numbers: Various Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: DCFS’s Fraud and Recovery Unit identified possible improper activity by two employees who appear to have violated department policy as well as state law related to payroll. Two employees suspected of department policy violations are as follows: • One former employee received wages from DCFS and another employer for some of the same hours worked during the period June 2020 through April 2023, resulting in a loss of $875 impacting various federal programs. The employee was terminated in September 2023. • One former employee is suspected to have received wages from DCFS and another employer for some of the same hours worked during the period January 2023 through June 2023, resulting in a possible loss of $15,474 impacting various federal programs. The employee resigned in September 2023 before DCFS informed the employee of the suspected violations. Criteria: DCFS Policy 4-2 states that Civil Service Rule 15.2 requires certification of payroll and attendance records by both an employee and his/her appointing authority or designee of hours actually worked and leave taken during a payroll period. Cause: The employees did not adhere to department policy. Effect: Amounts not recouped by DCFS as of June 30, 2023, totaled $16,349 and represent questioned costs. Recommendation: Management should continue to investigate improper employee activities and emphasize the criminal consequences of such activities. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-4).

2023-005 - Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act Award Years: 2021 - 2023 Award Numbers: 226LA324N1099, 226LA324N1199, 226LA325N1050, 226LA325N1150, 226LA344N2020, 226LA375L1603, 226LA400N8903, 236LA324N1099, 236LA324N1199, 236LA325N1050, 236LA325N1150, 236LA344N2020, 236LA375L1603, 236LA400N8903, S425B200042, S425D210003, S425U210003, S425W210019 Compliance Requirement: Reporting Repeat Finding: Yes (Prior Year Finding No. 2022-014) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive audit, the Department of Education (DOE) did not fully comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements. Our procedures disclosed the following: • For the Child Nutrition Cluster and the Child and Adult Care Food Program, DOE overreported subaward amounts in the FFATA Subaward Reporting System (FSRS) by approximately $2.3 billion. For these programs, DOE reported $529,389,579 in expenditures for subawards on the Schedule of Expenditures of Federal Awards for the period of July 1, 2022, through June 30, 2023, but reported $2,831,811,504 in subawards in FSRS for the same period. • For the Education Stabilization Fund (ESF) program, a test of 473 subawards totaling $293,838,031 related to 20 subawardees showed that DOE reported the incorrect obligation date in FSRS for 28 subawards totaling $966,100. See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR Part 170 Appendix A(I)(a) requires the non-federal entity to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity into the FSRS no later than the end of the month following the month in which the obligation was made. Cause: This noncompliance occurred due to a weakness in internal controls over FFATA reporting and, as indicated by management, because the report generated from the Child Nutrition Program system that is used to upload data to FSRS each month was programmed to contain cumulative data instead of monthly data. Effect: Reporting inaccurate information to FSRS prevents the public from having access to accurate information on how DOE is obligating federal funds. Recommendation: While there was significant improvement in reporting for ESF, DOE should continue to strengthen internal controls to ensure accurate information is reported and should correct all amounts and obligation dates that were previously reported incorrectly. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a plan of corrective action (B-7).

2023-006 - Noncompliance with and Weakness in Controls over Federal Research and Development Expenses Award Years: Various Award Numbers: Various Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Pass-Through Entities: Various Repeat Finding: Yes (Prior Year Finding No. 2022-005) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fifth consecutive year, the Louisiana State University Health Sciences Center in Shreveport (LSUHSC-S) did not ensure internal control over documentation of personnel services were operating effectively, and did not ensure compliance with federal guidance regarding cost transfers applicable to the Research and Development (R&D) Cluster. In a non-statistical random sample of 25 out of 2,401 payroll-adjusting entries affecting R&D, we noted the following: • Six (24%) adjustments did not have adequate documentation for cost transfers to fully explain how the error occurred and a sufficient explanation to support the correctness of the new charge. • Nine (36%) adjustments were not completed within 90 days of when the error was discovered. • One (4%) adjustment added unallowed expenses to a federal award project and is considered questioned costs totaling $2,619. We also performed an analysis of payroll adjusting journal entries to record cost transfers to and/or from R&D awards. We noted that 728 (36%) out of 2,030 adjusting journal entries were made more than 90 days after the end of the biannual period from the original transactions. The adjustments were made 92 to 467 days after the end of the biannual period. In addition, in a non-statistical random sample of 57 out of 11,827 expense transactions charged to R&D during the fiscal year ending June 30, 2023, we noted two (6%) of 32 time and effort certifications for salary and related benefit expenses tested were completed 126 to 140 days after the end of the semiannual period. Criteria: 2 CFR 200.430(i)(1)(i) requires that charges to federal awards for salaries and wages must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Per 2 CFR 200.430(i)(1)(viii), budget estimates alone do not qualify as support for charges to federal awards, but may be used for interim accounting purposes, provided that significant changes in work activity are identified and entered into the records in a timely manner and the non-federal entity’s system of internal controls includes processes to review after-the-fact charges and make necessary adjustments. Per LSUHSC-S’s Time and Effort Certification Policy and Procedures, LSUHSC-S utilizes time and effort certifications to support salary charges to sponsored projects as an after-the-fact certification of effort of all individuals when all or a portion of their salaries are charged to a sponsored project. Based on LSUHSC-S’s policy, time and effort certifications should be completed within approximately 90 days of the end of the biannual period. Management interprets the end of the period to be when the time and effort reports are sent to the departments once the last month of the biannual period is closed in the accounting system. If there is a substantial (5% or more) difference between the salary charges and the effort actually expended by the individual on projects during the biannual reporting period, a payroll reallocation must be created within 30 days. Per 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award. These internal controls should be in compliance with guidance in the “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission. Per the Standards for Internal Control in the Federal Government, examples of common categories of control activities include accurate and timely recording of transactions. In addition, the National Institute of Health (NIH) is the grantor for the majority of LSUHSCS’s R&D grant awards. Per the NIH Grants Policy Statement 7.5, cost transfers that represent corrections of clerical or bookkeeping errors should be accomplished within 90 days of when the error was discovered. The transfers must be supported by documentation that fully explains how the error occurred and a certification of the correctness of the new charge by a responsible organizational official. An explanation merely stating that the transfer was made “to correct error" or "to transfer to correct project" is not sufficient. Transfers of costs from one project to another or from one competitive segment to the next solely to cover cost overruns are not allowable. 2 CFR 200 Subpart E and the terms and conditions of the award establish requirements for non-federal entities receiving federal awards that govern the allowability of costs. Cause: LSUHSC-S implemented a revised Personnel Change (PER) form at the beginning of fiscal year 2023, which was designed to include an explanation and justification for any changes in faculty compensation on projects funded by federal awards. The departmental business managers, who are responsible for initiating PER forms, are not providing a full explanation for how errors occurred and the PER forms are not being processed timely. In addition, LSUHSC-S faculty are not completing time and effort certifications timely, which contributes to untimely adjustments for compensation. Effect: Untimely certifications and the untimely discovery and correction of errors increases the risk of inaccurate reporting and may result in an inability to complete approved projects within the approved budget and/or period of performance. As a result, LSUHSC-S may have to utilize university funds to complete approved projects. In addition, inadequate controls and noncompliance with federal awards increases the likelihood of disallowed costs, which LSUHSC-S may have to repay to the federal grantor. Recommendation: Management should monitor, investigate, and obtain justification from department personnel for untimely time and effort certifications, untimely adjustments, and lack of supporting documentation for adjustments to enforce established policies. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-43).

2023-007 - Control Weakness and Noncompliance with Personnel Expenses Charged to Federal Awards Award Years: 2018, 2020, 2021, 2022 Award Numbers: 1815976, 2033380, 2117785, 2120015, 2000629518, 22-PA-11080600-187, 5U19AI142636-05, 75N93020D00008/75N93020F00004, DE-AC07-05ID14517, DE-SC0019956, EMW-2021-SS-00019-S01, NA20OAR4310253C Compliance Requirements: Allowable Costs/Cost Principles, Special Tests and Provisions Pass-Through Entities: Battelle Energy Alliance, Norwich Technologies Inc., University Corporation for Atmospheric Research Repeat Finding: Yes (Prior Year Finding No. 2022-006) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, the University of Louisiana at Lafayette (UL Lafayette) did not have adequate controls in place to ensure personnel expenses charged to federal R&D awards accurately reflected work performed. From a population of 28,301 payroll and non-payroll expenses charged to R&D grants for the fiscal year ended June 30, 2023, a non-statistical sample of 25 transactions were tested for compliance with allowable costs and cost principles requirements. For five (20%) of the transactions, UL Lafayette was unable to provide documentation to show that personnel related expenses totaling $612 were supported by time and effort certifications to ensure the accuracy of budget estimates charged to federal awards as required by federal regulations. We reviewed 15 grant awards corresponding to the expense transactions selected and evaluated documentation to support the level of effort for each award and the 20 key personnel assigned to the selected awards. For 13 (65%) of the key personnel, UL Lafayette was unable to provide documentation that the key personnel complied with the effort required by the grant award. Criteria: 2 CFR 200.430(i) specifies the documentation standards for personnel expenses. In order to be allowable, charges to federal awards for personnel expenses must be based on records that accurately reflect the work performed and must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Budget estimates alone do not qualify as support for charges to federal awards, but can be used for interim accounting purposes provided that internal controls include an after-the fact review to confirm the accuracy of final amounts charged to federal awards. Prior approval requirements related to key personnel effort are contained in 2 CFR 200.308(c) and within grant terms and conditions. A reduction of 25% or greater in time devoted to the project from key personnel requires prior approval as does disengagement of key personnel from the project for three or more months. Cause: UL Lafayette noted in their prior-year corrective action plan and in a draft effort reporting policy that certifications for employees charging time to federal awards would be required quarterly. For the fiscal year ended June 30, 2023, certifications were only requested in July 2023, after the fiscal year-end, and were required to be returned within 30 days. Annual certifications are not sufficient to timely detect changes in key personnel effort and ensure prior approvals are obtained when applicable. Effect: Inadequate controls related to federal documentation standards for personnel expenses could result in noncompliance with federal allowable costs and cost principles, as well as noncompliance with special tests and provisions related to key personnel effort. Recommendation: Management should strengthen internal controls to ensure that personnel expenses charged to the federal awards are supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Additionally, management should revise the Time and Effort Certification policy or implement alternative controls designed to ensure compliance with special tests and provisions requirements. Management should monitor changes in effort for key personnel and ensure that prior written approval is obtained from the federal grantor for changes that exceed the thresholds set in federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-59).

2023-008 - Noncompliance with Subrecipient Monitoring Requirements Award Years: 2019, 2020, 2022 Award Numbers: 1903601, 80NSSC21M0333, OIA-1920858, OIA-2019511, OIA-2119688, U19AI142636-05 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2022-007) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, UL Lafayette did not adequately monitor subrecipients of the R&D Cluster programs. In a non-statistical sample of seven subawards out of a population of 43 subawards, it was noted that for five (71%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the financial and performance reports required by the subaward agreement were obtained and reviewed by UL Lafayette. For two (29%) of the subrecipients evaluated, the subaward documents did not contain the assistance listing number and/or the federal award date, as required by federal regulations. Criteria: Per 2 CFR 200.332(a)(1)(iv) and (xii), all pass-through entities must ensure that every subaward includes the federal award date; assistance listing numbers and title; the pass-through entity must identify the dollar amount made available under each federal award and the assistance listings number at time of disbursement. 2 CFR 200.332(d)(1) requires that pass-through monitoring include reviewing financial and performance reports required by the pass-through entity. Cause: UL Lafayette did not have controls in place to ensure adequate monitoring of subrecipients as required by federal regulations. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls to ensure that subaward documents contain all required information and that the required financial and performance reports are received and reviewed timely. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-61).

2023-009 – Noncompliance with Federal Equipment Management Regulations at LSU A&M Award Year: 2018 Award Number: AWDC-002209 Compliance Requirement: Equipment and Real Property Management Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Louisiana State University and A&M College (LSU A&M) did not comply with federal equipment management regulations. In a non-statistical sample of 30 items from a population of 1,389 assets indicated by management as being purchased with Research and Development funds for LSU A&M, one (3%) item could not be located. Criteria: 2 CFR 200.313(d)(1) and 2 CFR 200.313(d)(3) require that equipment records include the identification number, location, condition, source, and award number for each equipment item and adequate safeguards must be developed to prevent loss, damage or theft of property. Cause: LSU A&M did not have adequate controls in place to ensure that equipment was properly safeguarded against loss. Effect: Failure to comply with federal management regulations increases the risk that assets may be lost or stolen. Recommendation: Management should implement internal controls to ensure that equipment is properly safeguarded. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-38).

2023-010 – Inadequate Recovery of Small Rental Property Program Loans Award Years: 2006, 2007 Award Numbers: B-06-DG-22-0001, B-06-DG-22-0002 Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2022-009) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2023, the Division of Administration, Louisiana Office of Community Development (LOCD) identified five Small Rental Property Program (SRPP) loans totaling $471,293 for property owners under the Community Development Block Grant/State’s Program (CDBG) who failed to comply with one or more of their loan agreement requirements and were assigned to loan recovery status in fiscal year 2023. In addition, while completing their file review, LOCD identified $22,435,810 of outstanding SRPP loans for 131 loans assigned to loan recovery status in previous years, which included increases in loan balances totaling $9,083,940 during the fiscal year. Since LOCD has not recovered these loans, we consider these amounts totaling $9,555,233 to be questioned costs. An additional 678 noncompliant loans identified in previous years totaling $60.6 million remain outstanding. As of June 30, 2023, of the 4,476 outstanding SRPP loans totaling $436.1 million, 648 noncompliant loans totaling $68.7 million were in active recovery status, and LOCD represented that recovery efforts were ongoing to either recoup the loan funds or work with the applicants to bring them into compliance with the state’s continuing requirements of the program. The remaining 166 noncompliant loans totaling $14.8 million have been determined by LOCD to be uncollectable for various reasons such as foreclosure, property seizure, or legal dispute. Criteria: OMB Circular A-87, Cost Principles for State, Local, and Indian Tribal Governments (now located in 2 CFR 225) stipulates that the state assume responsibility for administering federal awards in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to hurricanes Katrina and Rita, the state was awarded and has allocated approximately $653 million to the SRPP, as part of the Road Home program. In accordance with the state’s U.S. Department of Housing and Urban Development (HUD)-approved Action Plan Amendment 24, the SRPP offers forgivable loans to qualified property owners who agree to offer rental properties at affordable rents to be occupied by lower-income households. In exchange for accepting loans ranging between $10,000 and $100,000 per rental unit, property owners are required to accept limitations on rents and incomes of renters during an “affordability period,” a specified period of time based on the amount of funding received and the type of work being done (renovation or full construction) ranging between three and 20 years. The loan amounts are determined based on location of property, number of bedrooms, and the poverty level of the renter. In addition to accepting limitations on rents and income of renters, property owners also agree to maintain property insurance and maintain flood insurance, if necessary. These requirements become effective one year after the closing date and remain until the expiration of the “affordability period.” According to the loan agreements, failure to comply with any of the loan requirements shall constitute default and mandatory repayment. Good internal controls would ensure that policies and procedures are in place with an established timeline to monitor compliance with the loan agreements and provide for specific actions (i.e., loan modification, foreclosure, or repayment) if a property owner fails to comply with the loan agreement or does not provide evidence of compliance as required by the loan agreement. Cause: In June 2016, HUD issued a monitoring review report with a finding that the SRPP design lacked sufficient fiscal accounting controls and procedures to ensure that CDBG funds identified as ineligible expenses are able to be recaptured and repurposed for eligible uses. Since that time, there have been several monitoring reports indicating progression in this area. In June 2023, HUD issued a formal letter of guidance to LOCD that included recommended actions to resolve the remaining SRPP ineligible costs. In its responses to HUD’s proposals and recommendations, LOCD is working with HUD to implement final corrective action to resolve the HUD issued finding and close out the SRPP. Effect: Ultimately, LOCD’s failure to recover loans from noncompliant property owners could result in disallowed costs. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of the awards. Recommendation: LOCD should continue working with HUD towards resolving the outstanding questioned costs and closing out the SRPP. Management’s Response and Corrective Action Plan: LOCD stated in its response that it will continue to assist rental property owners to become compliant and to resolve any program compliance issues, thus increasing available affordable rental housing and reducing or eliminating the need to recapture funds from rental property owners, where appropriate (B-9).

2023-011 – Restore Louisiana Homeowner Assistance Program Awards Identified for Grant Recovery Award Year: 2016 Award Number: B-16-DL-22-0001 Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2022-010) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2023, LOCD identified $56,116 in noncompliant Restore Louisiana Homeowner Assistance Program (RLHAP) awards for ten homeowners through established program implementation and monitoring procedures for the CDBG. Since LOCD has not recovered these noncompliant awards at year-end, we consider these amounts to be questioned costs. In addition, 37 noncompliant files totaling $618,085 identified in the previous years are still outstanding. LOCD is actively pursuing collections on the files. As of June 30, 2023, $669,687,346 in total RLHAP awards have been disbursed to 17,262 homeowners. LOCD is actively reviewing seven files totaling $67,240 to make final determinations of the homeowner’s noncompliant status. At year-end, LOCD reported that 271 homeowner files totaling approximately $4.6 million have been reviewed through its monitoring procedures. Of the 271 homeowners, LOCD reported 54 homeowners were placed in recapture status, 168 homeowners were cleared through the review process, 17 homeowners returned their grant award, in whole or in part, and 32 homeowners entered into repayment plans. Criteria: 2 CFR 200 Subpart E stipulates that the state assumes responsibility for administering federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to the March and August Floods of 2016, the state was awarded approximately $1.07 billion to administer the RLHAP. In accordance with the state’s HUD-approved Action Plan, eligible homeowners must enter into grant agreements with the state which require homeowners to comply with program requirements in exchange for compensation to rehabilitate or reconstruct their damaged property. Homeowners have three program options to choose from based on their progress in the rebuilding process and their capacity to complete their home repair or reconstruction. Eligibility and grant award calculations are determined based on information provided by the homeowner, the results of field inspections, and available third-party datasets. Once eligibility has been established and award amounts have been calculated, funds are awarded to the homeowner upon the effective date of signing the grant agreement, which is referred to as the closing date. Should homeowners experience a change in the circumstances after grant determination or if additional information becomes available after closing, homeowners’ grant calculation or program eligibility may change. In the event the change reduces their amount of eligible funding, RLHAP may require that a homeowner return all or a portion of their award. Cause: Circumstances that may result in homeowners being required to repay all or a portion of the award include: duplicative benefits received but not included in initial grant award calculation, information discovered identifying the homeowner as ineligible for the award received, failure to complete construction per program requirements, substantial noncompliance with requirements of grant agreements, voluntary withdrawal from the program, or discovery that the homeowner provided false or misleading information during the grant award process. Effect: If LOCD is unable to recover benefits from noncompliant homeowners, disallowed costs could result. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of these awards. Recommendation: LOCD should continue its monitoring to identify awards to be placed in recovery and continue recovery efforts to collect those awards determined to be noncompliant. Management’s Response and Corrective Action Plan: LOCD agreed that the identified files have been placed in recapture and stated it will continue to follow the established recapture procedures for these grant awards to ensure ultimate compliance (B-11).

2023-012 - Inadequate Controls over and Noncompliance with Subrecipient Monitoring Requirements Award Years: 2020 - 2023 Award Numbers: AA347712055A22, AA363222155A22, AA385322255A22 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2022-011) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fifth consecutive year, the Louisiana Workforce Commission (LWC) did not adequately monitor subrecipients under the Workforce Innovation and Opportunity Act (WIOA) Cluster programs. In addition, LWC did not adequately review subrecipient Single Audit reports and issue timely management decisions on findings affecting the WIOA Cluster programs. LWC’s WIOA expenditures during state fiscal year 2023 totaled over $56.5 million with approximately $47.1 million provided to subrecipients. Our review of LWC’s fiscal year 2023 monitoring reports for plan year 2020/fiscal year 2021 disclosed the following for LWC’s 15 subrecipients: • For five monitoring reports, close out letters were issued between 111 and 183 days after report issuance. For four monitoring reports, close out letters were not issued as of January 2024, while the monitoring reports for these reviews were issued more than 195 days prior. One report included a finding with possible questioned costs of $563,649 that is unresolved at the time of our review. Our review of LWC’s review of Single Audit reports disclosed the following for LWC’s 15 subrecipients: • For three Single Audit reports with findings affecting the WIOA cluster of programs, management decision letters were issued 66 to 264 days after the due date set by federal regulations. In addition, for two of the three reports, LWC incorrectly issued management decisions letters noting no WIOA affected findings. Each of the noted reports contained one finding affecting the WIOA Cluster programs. Criteria: 2 CFR 200.332(d) requires that pass-through entities monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. 2 CFR 200.332(d)(2) requires that pass-through entities follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient. 2 CFR 200.521(c) requires that pass-through entities issue management decisions for audit findings related to federal awards they make to subrecipients, and 2 CFR 200.521(d) requires that pass-through entities responsible for issuing management decisions issue their management decisions within six months of the acceptance of the audit report by the Federal Audit Clearinghouse. Cause: LWC policy does not specifically address timeliness requirements for close out letters. LWC failed to implement adequate internal controls to ensure that subrecipients’ Single Audit reports are reviewed and required management decision letters are issued by the deadlines established by federal regulations. Effect: Failure to timely resolve documentation and questioned costs impairs LWC’s ability to ensure that program funds passed through to its subrecipients were spent in accordance with program regulations and increases the risk of improper payments to subrecipients, which LWC may have to repay to the federal grantor. These risks are also increased by LWC’s failure to implement adequate internal controls to ensure that subrecipients’ Single Audit reports are reviewed and required management decision letters are issued by the deadlines established by federal regulations. Recommendation: LWC management should develop and implement policy ensuring timely close out of monitoring reviews. LWC should also implement adequate internal controls to ensure that it identifies and follows up on subrecipients’ audit findings as specified and issues required management decision letters by the due date set by federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-46).

2023-013 - Noncompliance and Inadequate Controls Related to Reporting Requirements for the Federal Funding Accountability and Transparency Act Award Year: 2023 Award Number: AA385322255A22 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: For the WIOA Cluster programs, LWC did not have adequate internal controls in place to review and approve data submissions to the FFATA Subaward Reporting System (FSRS) website required for federal subawards by the Federal Funding Accountability and Transparency Act (FFATA). While the required data elements for LWC’s 15 WIOA subawards submitted to the FSRS website were complete and accurate, the data submissions for the 15 subawards occurred between one and three months after the due date specified by federal regulations. All 15 subawards executed and submitted during state fiscal year 2023 exceeded $30,000 and collectively totaled over $38.7 million. Criteria: 2 CFR 200.303 requires non-federal entities receiving federal award to establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 170 Appendix A(I)(a) requires the non-federal entity to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity into the FSRS website no later than the end of the month following the month in which the obligation was made. Cause: LWC management represented that a staff member, other than the compiler of the data that was submitted, observed the data as it was being submitted to the FSRS website and reviewed and approved it as complete and accurate based on this observation. However, management was not able to provide evidence of the review and approval of the data submissions. In addition, as noted above, the data submissions occurred after the due date specified in federal regulations. Effect: Failure to implement adequate internal controls over the data submissions to the FSRS website as required by the FFATA could result in required data submissions being incomplete, inaccurate, and/or untimely, as evidenced by the late data submissions noted above, which resulted in noncompliance with federal regulations. Recommendation: LWC should strengthen internal controls, including maintaining evidence of reviews, to ensure compliance with federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-49).

2023-014 – Inadequate Controls over and Noncompliance with Wage Rate Requirements Award Years: 2004, 2009, 2012, 2019, 2021-2023 Award Number: Not Applicable Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Transportation and Development (DOTD) did not adhere to policies designed to ensure compliance with federal wage rate requirements for construction projects funded through the Highway Planning and Construction program. In addition, DOTD did not comply with a portion of the federal wage rate requirements. Our procedures disclosed the following: • From a population of 427 federally-funded projects in the construction phase with expenditures during fiscal year 2023, two (4%) of the 56 projects tested in a non-statistical sample had partial estimates approved for payment prior to DOTD reviewing the required weekly certified payrolls from the contractor. • From a population of 133 federally-funded projects that were completed during fiscal year 2023, three (21%) of the 14 projects tested in a non-statistical sample did not have an adequate review of the site interviews, including two projects that did not have evidence of review on the site interview form, and one project where the site interview form could not be located, resulting in noncompliance with wage rate requirements. In addition, we reviewed three projects in addition to those sampled above and noted one individually important project did not have evidence of review on the site interview form. Criteria: The Davis-Bacon Act (40 USC 3141-3147) requires that all laborers and mechanics employed by contractors or subcontractors on construction work performed on federally-funded highway projects with construction contracts in excess of $2,000 must be paid wages at rates not less than those prevailing on the same type of work on similar construction in the immediate locality as determined by the U.S. Department of Labor (23 USC 113). The contractor or subcontractor must submit weekly certified payrolls for each week any covered work is performed [29 CFR 5.5(a)(3)(ii)(A)] and a statement of compliance. Per 29 CFR 5.6(a)(3), employee interviews should also be conducted to ensure that the work performed by construction workers and mechanics is consistent with the corresponding job titles and wages being reported on the certified payrolls. To ensure compliance with wage rate requirements, DOTD’s policy is to approve payment of the contractors’ partial estimates after all required certified payrolls for the estimate period are submitted to DOTD. In addition, DOTD’s Engineering Directives and Standards Manual (EDSM) requires that a minimum of one site interview per project be conducted by the Project Engineer on all federally-funded projects with a wage decision. Cause: Personnel did not adhere to the guidelines set forth in DOTD’s EDSM related to the required interviews and the practice to only approve construction estimates for payment after the submission of certified weekly payrolls by contractors. Effect: Failure to follow established internal controls and guidelines set forth in DOTD’s EDSM resulted in noncompliance with department policy and with the federal wage rate requirements; this could potentially result in contractors not paying laborers and mechanics the prevailing wage rates. Recommendation: Management should enforce internal controls and the policies established within DOTD’s EDSM to ensure compliance with federal wage rate requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-53).

2023-015 – Untimely Submission of Summary of Samples and Test Results Form Award Years: 2004–2006, 2012–2013, 2015, 2017-2022 Award Numbers: Not Applicable Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: DOTD did not have adequate controls in place to ensure the Summary of Samples and Test Results Form (Form 2059), which is part of DOTD’s project close-out documentation, was completed timely for projects of the Highway Planning and Construction program. DOTD’s Construction Contract Administration Manual requires the Summary of Samples and Test Results Form to be submitted with the project close-out documentation. In practice, DOTD requires this form to be submitted within 90 days of final acceptance of the project. The Summary of Samples and Test Results Form is certified by applicable engineers and includes documentation relating to the quality of materials used for the project, including the sampling plans and test results of the materials. In a non-statistical sample of 16 projects reviewed from a population of 160 projects receiving final acceptance in fiscal year 2023, DOTD did not ensure the Summary of Samples and Test Results Form was completed within 90 days of the project’s final acceptance for nine (56%) of the projects tested. • For four (25%) of these projects, the form was completed untimely, ranging from 107 to 175 days after final acceptance. • For five (31%) of these projects, the form was not completed as of November 2023, with final acceptance dates in October 2022, December 2022, March 2023, May 2023, and June 2023. Criteria: 23 CFR 637.205(a) requires that state transportation departments develop a quality assurance program which will assure that the materials and workmanship incorporated into each federal-aid highway construction project are in conformity with the requirements of the approved plans and specifications. Cause: DOTD did not ensure that the district engineers approved and submitted the Summary of Samples and Test Results Form to DOTD Headquarters in a timely manner. Effect: Untimely completion of the Summary of Samples and Test Results Form delays validation that the sampling and testing results were in accordance with DOTD’s quality assurance program. The absence of such documentation could result in a lack of support that the quality of materials and workmanship used met the requirements for a federally funded project. Recommendation: DOTD should continue tracking projects receiving final acceptance and emphasize the importance of timely submittal of the Summary of Samples and Test Results Form to district engineers. In addition, DOTD may consider alternative methods for district engineers to document their review and approval of the sampling and testing results. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-56).

2023-016 – Inadequate Controls over and Noncompliance with Higher Education Emergency Relief Fund Requirements Award Year: 2023 Award Number: P425F201650 Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Central Louisiana Technical Community College (CLTCC) overdrew $139,483 of Higher Education Emergency Relief Fund (HEERF) grant funds in fiscal year 2023 as a result of incorrectly including the Oakdale campus activity in their calculation of lost revenue for state fiscal year 2023. CLTCC transferred the operations of the Oakdale campus to SOWELA Technical Community College on July 1, 2018. The transfer of the Oakdale campus was not associated with coronavirus, as required by the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) Section 314(c)(1) for HEERF funding. Criteria: Per the American Rescue Plan, the same terms and conditions of the CRRSAA apply. Per the CRRSAA Section 314(c)(1), an institution of higher education may use HEERF to defray expenses associated with coronavirus (including lost revenue). On March 19, 2021, the U.S. Department of Education (USDOE) published a HEERF I, II, and III Lost Revenue Frequently Asked Questions (FAQ) to provide further clarification regarding the calculation of lost revenue. Per the FAQ under Question No. 5, if the lost revenue is directly attributable to a cause other than the COVID-19 pandemic, the institution may not include those lost revenues in its estimation of its lost revenue for the HEERF grant programs. Cause: CLTCC did not have adequate controls in place over lost revenue calculations for HEERF funding to ensure compliance with guidance provided by the USDOE. Effect: Failure to adequately review and follow federal guidance increases the risk that unallowable costs could be reimbursed by a federal agency. Recommendation: Management should ensure adequate controls are in place to ensure compliance with federal regulations and follow guidance provided by the USDOE for the calculation of lost revenues. CLTCC should also revise its lost revenue calculation and return any overdrawn funds to the federal grantor. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-2).

2023-017 - Control Weakness over Higher Education Emergency Relief Fund Requirements Award Year: 2023 Award Number: P425F201887 Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2022-016) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, Southern University at Baton Rouge’s (SUBR) calculation of lost revenue under HEERF had errors. SUBR failed to include one category of revenues, included the incorrect amount for another category of revenues, and improperly included revenues not related to higher education. Criteria: Per the American Rescue Plan, the same terms and conditions of the CRRSAA apply. Per the CRRSAA Section 314(c)(1), an institution of higher education may use HEERF to defray expenses associated with coronavirus (including lost revenue). On March 19, 2021, the USDOE published a HEERF I, II, and III Lost Revenue FAQ to provide further clarification regarding the calculation of lost revenue. Per the FAQ under Question No. 9, an institution’s calculation of lost revenue must be consistent with the cost principles of the Uniform Guidance (2 CFR 200 Subpart E): must be accorded consistent treatment (e.g., if using the institution’s fiscal year as a baseline, the institution must estimate lost revenue over the course of a fiscal year) and be consistent with policies and procedures that apply uniformly to federally-financed and other activities of the institution. Per 2 CFR 200.303(a), the non-federal entity must establish and maintain effective internal control over the federal award. These internal controls should be in compliance with guidance in the “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission. Cause: SUBR did not have an effective review process to ensure the lost revenue calculation was accurate and only included revenues that could be reimbursed by the federal grantor. Effect: Failure to adequately review the lost revenue calculations resulted in a net under draw of federal funds and increases the risk that unallowable costs could be reimbursed by the federal agency. Recommendation: Management should strengthen its review process to ensure the calculation of lost revenues is accurate and only includes revenues that meet federal program requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-50).

2023-018 - Control Weakness over Higher Education Emergency Relief Fund Reporting Award Year: 2023 Award Numbers: P425E200926, P425F201887, P425J200055 Compliance Requirement: Reporting Repeat Finding: Yes (Prior Year Finding No. 2022-015) See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR did not ensure the accuracy of the annual report for the HEERF program, and Southern University Law Center (SULC) did not maintain supporting information for portions of the HEERF program annual report. Based on our procedures, the following differences were identified: • The HEERF - Student Aid Portion (84.425E) was fully expended in calendar year 2022. The total of emergency financial aid grants awarded to students included on the 2020, 2021, and 2022 annual reports was $243,869 less than the total amount awarded and drawn down by SUBR. • There were 15 less SULC graduate students still enrolled at the university than what was reported on the annual report. Also, there were 14 more SULC graduate students that withdrew from the university than what was included on the annual report. These differences persisted in the annual report when categorizing the students as either full-time or part-time, by race/ethnicity, gender, and age. SULC management represented that the enrollment information included in the annual report matched previously prepared support, but management could not provide such support. Criteria: The Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 18004(e), CRRSAA Section 314(e), and the American Rescue Plan (ARP) Act Section 2003 require an institution receiving funds under HEERF I, HEERF II, and HEERF III to submit a report to the secretary, at such time in such a manner as the secretary may require. Cause: SUBR procedures to prepare the HEERF annual report were not sufficient to ensure the total program award amount and student data were reported accurately. Also, SULC procedures did not ensure certain supporting information used to compile student counts were retained. This is the fourth consecutive year we have reported control weaknesses over HEERF reporting. Effect: Failure to maintain adequate controls related to preparing the HEERF annual report and retaining support for certain amounts on the report increases the risk that errors or omissions may occur and remain undetected resulting in noncompliance with federal requirements. Recommendation: Management should strengthen its procedures over the preparation of the annual report and retention of supporting documentation to ensure compliance with federal reporting requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-51).

2023-019 - Noncompliance with and Control Weakness over Social Services Block Grant Activities Allowed or Unallowed Award Years: 2022, 2023 Award Numbers: 2201LASOSR, 2301LASOSR Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Children and Family Services (DCFS) transferred $16 million of Temporary Assistance for Needy Families (TANF) grant funds to the Social Services Block Grant (SSBG) during fiscal year 2023. As of June 30, 2023, DCFS did not have a formalized process in place to ensure TANF transfers to SSBG were only used for programs or services for children or their families whose income is less than 200 percent of the poverty level. Criteria: Per 45 CFR 75.303(a), the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Per 42 USC 604(d)(3)(B), all TANF amounts paid to a state that are used to carry out state programs under SSBG shall be used only for programs and services to children or their families whose income is less than 200 percent of the income official poverty line. Cause: As a result of not having formalized procedures, DCFS utilized the $16 million of TANF funds transferred during fiscal year 2023 on salaries for DCFS caseworkers through its Public Assistance Cost Allocation Plan, which is not an allowed activity. Effect: Failure to implement proper controls over managing SSBG expenditures resulted in noncompliance with federal regulations and $16 million in questioned costs. Recommendation: While subsequent to June 30, 2023, DCFS developed written policies and procedures; DCFS should ensure the income requirements applicable to the TANF transfers to SSBG are met and funds are used in accordance with federal requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-5).

2023-020 - Inadequate Controls over and Noncompliance with National Correct Coding Initiative Requirements Award Years: 2022, 2023 Award Numbers: 2205LA5MAP, 2305LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2022-024) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, the Louisiana Department of Health (LDH) failed to properly implement and monitor National Correct Coding Initiative Requirements (NCCI) for Medically Unlikely edits (MUE) and Procedure-to-procedure (PTP) edits for the Medical Assistance Program (Medicaid) fee-for-service (FFS) claims. MUE is an edit on claims in which the number of units billed on the claim are more than what is considered necessary/allowed for a particular procedure code and PTP is an edit on claims in which one specific procedure code is not allowed to be billed with a different specific procedure code on the same recipient on the same day by the same provider. Our testing of NCCI edits included all FFS claims for Durable Medical Equipment (DME), Outpatient Hospital Service (OP), and Practitioner and Ambulatory Surgical Center (PRA) paid in state fiscal year 2023. These claims were subject to two edit types: MUE and PTP. In a test of 6,240,335 paid claims to determine if the proper NCCI MUE and PTP edits had been implemented, the following was noted: • 1,588 claims for DME, OP, and PRA were paid but should have been evaluated by an NCCI MUE and denied. These NCCI MUE edit errors resulted in questioned costs of $126,549 in federal funds. • 43 claims for DME, OP, and PRA were paid but should have been evaluated by an NCCI PTP edit and denied. These NCCI PTP edit errors resulted in questioned costs of $1,663 in federal funds. Criteria: Section 1903(r) of the Social Security Act requires State Medicaid agencies to incorporate NCCI methodologies into State Medicaid programs. Federal regulations and the NCCI Medicaid Technical Guidance Manual contains requirements for implementation of the NCCI methodologies. Cause: LDH noted that required NCCI MUE edits were not applied to OP and DME FFS claims due to system constraints for the first three quarters of the fiscal year. In April 2023, LDH implemented the newest version of the clinical editing product ClaimsXten, which now houses all of the required Medicaid NCCI edits. Once implemented, LDH requested the Medicaid Fiscal Intermediary to reprocess all OP and DME claims for fiscal year 2023 in order to identify claims that should have been evaluated by an NCCI edit and denied. The Medicaid Fiscal Intermediary reprocessed all claims as requested, however, they did not recoup the payments associated with the identified claims. Effect: Failure to properly implement and enforce all required NCCI edits increases the likelihood that FFS claims, which should be denied, could potentially be paid. Recommendation: LDH management should ensure all required NCCI edits are properly applied to FFS claims. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-17).

2023-021 - Inadequate Controls over Billing for Behavioral Health Services Award Years: 2022, 2023 Award Numbers: 2205LA5021, 2205LA5MAP, 2305LA5021, 2305LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2022-025) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fifth consecutive year, LDH, the Managed Care Organizations (MCOs), and Magellan Health Services (Magellan) did not have adequate controls in place to ensure that behavioral health services in Medicaid and the Children’s Health Insurance Program (CHIP) were properly billed and that improper encounters were denied. For fiscal year 2023, we identified approximately $16 million in encounters for services between July 1, 2022, and June 30, 2023, that were paid by the MCOs and Magellan even though the encounters do not appear to comply with LDH’s encounter coding requirements and/or approved fee schedules. Our analysis identified the following instances of billing errors: • Providers were paid $11,544,123 for 158,173 encounters that were billed using incorrect procedure and modifier codes. • Providers were paid $4,459,886 more than indicated on approved fee schedules for 59,902 encounters for behavioral health services. Criteria: LDH’s fee schedule outlines procedure codes for services and the applicable billing rates. Some services require that procedure codes also contain modifier codes which indicate information such as the age of the recipient, location where the service was provided, the educational background of the person providing the service, and the license(s) they have obtained. The approved fee schedules outline different rates depending on the procedure code and modifier codes. The MCOs can optionally pay more than the minimum LDH fee schedule. Cause: In following its corrective action plan from fiscal year 2022, LDH contracted with the External Quality Reviewer (EQR) to validate a representative sample of encounters against the Medicaid fee schedule on file at the time of service delivery, inclusive of modifier utilization. Although implementation of this protocol began in fiscal year 2023, all quarters were not completed prior to the end of the fiscal year. Auditors also noted that the EQR’s analysis excluded encounters with location modifiers and included providers that were approved to bill in excess of the fee schedule. Finally, the analysis did not appear to evaluate if the rate billed on the encounter matched the education level modifier. The billing errors could be avoided by LDH, the MCOs, and Magellan applying system edits that would flag encounters for further review when encounter coding and/or fee schedule requirements are not followed. Effect: Without the required modifiers, the encounter does not contain enough information to determine that the billing was appropriate. Because LDH does not currently maintain a list of providers in which the MCO pays more than the minimum fee schedule, LDH cannot determine if an encounter paid at an excessive rate was improperly billed. It is important that encounter data is accurate because LDH and other stakeholders, such as the Medicaid Fraud Control Unit within the Attorney General’s Office, use this data to identify improper payments and potential fraud. LDH also used this encounter data to establish per member per month rates for the MCOs. Recommendation: LDH management should ensure that agency personnel are adequately monitoring the EQR contract and that the proper validations are being conducted to ensure encounters are coded correctly. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-21).

2023-022 - Inadequate Controls over Reporting and Other Federal Compliance Requirements for the Medicaid and Children’s Health Insurance Programs Award Years: 2022, 2023 Award Numbers: 2205LA5021, 2205LA5MAP, 2305LA5021, 2305LA5MAP Compliance Requirements: Matching, Earmarking, Period of Performance, Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH erroneously double-reported expenditures for the Medicaid program, resulting in questioned costs, and did not complete certain quarterly checklist reviews intended to ensure compliance with the reporting and matching federal compliance requirements for the Medicaid program and the reporting, period of performance, matching, and earmarking federal compliance requirements for the CHIP program. LDH improperly included the same $16.6 million Medicaid expenditure on both the September 30, 2022, and March 31, 2023, quarterly federal expenditure reports. In addition, LDH did not complete two of the four (50%) quarterly checklist reviews for fiscal year 2023. Criteria: According to 2 CFR 200.302(b)(2), accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements set forth in 2 CFR 200.328 and 200.329 is required. The Medicaid and CHIP programs require quarterly reporting to Centers for Medicare and Medicaid Services (CMS) detailing expenditures by category of service for which states are entitled to federal reimbursement. The federal expenditures reported in the quarterly reports are used to reconcile the draws of federal funds. In addition, good internal controls require that policies and procedures are established and followed to ensure compliance with federal requirements. Cause: LDH did not ensure their controls over federal requirements were completed for every quarter during fiscal year 2023. In addition, LDH did not accurately complete the quarterly reconciliation, which is intended to ensure all items are accurately reported on the quarterly federal expenditure report. Effect: Double-reporting expenditures resulted in $14.9 million in federal questioned costs for the year ending June 30, 2023. As a result of not completing quarterly checklist reviews, LDH failed to detect the misreporting of a $1.7 million recoupment of Disproportionate Share Hospital payments on the wrong federal year schedule for the June 30, 2023, quarterly federal expenditure report. Recommendation: LDH management should strengthen controls over preparation and review of the quarterly federal expenditure reports to ensure federal expenditures are accurately reported and should ensure all quarterly checklist reviews are completed. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-23). Auditor’s Additional Comments: Management's response stated, "LDH disagrees that the quarterly checklist is intended to demonstrate compliance with the federal reporting requirements." LDH management previously represented that the quarterly checklist was part of LDH's internal control process to document the preparation and review of the quarterly federal expenditure reports. As stated in the finding, the noncompliance associated with federal reporting requirements occurred because LDH did not ensure their internal controls over federal requirements were completed for every quarter during fiscal year 2023.

2023-023 - Inadequate Controls over Waiver and Support Coordination Service Providers Award Years: 2022, 2023 Award Numbers: 2205LA5MAP, 2305LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH paid Medicaid Home and Community Based Services claims for the New Opportunities Waiver (NOW) for waiver services that were not documented in accordance with established policies. LDH also paid claims for support coordination services that were not documented in accordance with established policies. Our testing of NOW waiver services included 1,004 claims paid in fiscal year 2023 totaling $219,057 paid to three providers for 19 recipients. Our test identified errors for 371 claims totaling $21,222 in federal funds, with some claims having multiple errors. The following errors were noted: • For 349 claims for 18 recipients, the waiver services provider did not provide adequate documentation to support billed services. • For 55 claims for 18 recipients, the waiver services provider did not provide documentation to support deviations from the approved Plan of Care (POC), where the units of service provided were below the minimum amount required. In addition to testing NOW waiver services, we also tested claims paid for support coordination services for the 19 waiver recipients tested. In our test of 311 claims paid in fiscal year 2023 totaling $62,667 paid to four support coordination providers for the 19 recipients, the support coordination service provider did not provide adequate documentation to support billed services for 16 claims for five recipients. The federally funded portion of these claims totaled $2,347. Criteria: Waiver services are accessed through support coordinators who assist with development and monitoring of the recipient’s POC. Auditors used LDH’s provider manuals to identify required documentation, which includes an approved POC, time sheets or electronic clock in/out, and progress notes. Provider manuals are intended to give a provider the information needed to fulfill its vendor agreement with the state of Louisiana, and is the basis for federal and state reviews of the program. The recipients case record is required to include a copy of the approved POC, including any revisions. The POC documents the recipient’s assessed needs and types and quantity of services to address those needs and costs related to services. Direct service providers provide care to a recipient based on the approved POC. According to the NOW provider manual, an occasional or temporary deviation from a recipient’s scheduled services is acceptable as long as the services altered are recipient-driven, person-centered, and occur within the prior authorization. According to the LDH service coordination provider manual, service logs are the means for clearly documenting services billed and must be reviewed by supervisors. Cause: The errors noted in testing occurred because LDH failed to ensure that NOW waiver and support coordination providers follow LDH policies related to proper recordkeeping and supporting documentation. Effect: Without adequate documentation, a provider cannot substantiate, and auditors cannot verify that the deviations were recipient-driven and person-centered as required. Without adequate supporting documentation and compliance with LDH established policies, there is reduced assurance that billed services were actually performed, recipients are receiving needed services, and limited resources are allocated appropriately. Questioned costs totaling $23,569 in federal funds were noted in relation to the waiver services provider and support coordination services provider not providing adequate documentation to support billed services. Recommendation: LDH should ensure all departmental policies for waiver and support coordination services are enforced, including documentation to support claims and evidence that deviations from the approved POC meet the needs of the recipient. LDH should consider additional provider training regarding documentation requirements. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-25). Auditor’s Additional Comments: LDH noted in its response that it did not concur with the determination of inadequate controls and that a combination of factors and not documentation alone must be considered when determining whether billed services were performed. As noted in the finding, LDH’s provider manuals identify the required documentation for billing, which includes an approved POC, time sheets or electronic clock in/out, and progress notes. The errors noted above included one or a combination of these items to be missing for the recipient files tested; therefore, LDH failed to ensure that providers followed LDH policies.

2023-024 - Inadequate Internal Controls over Eligibility Determinations Award Years: 2019 - 2023 Award Numbers: 1905LA5MAP, 2005LA5021, 2005LA5MAP, 2105LA5021, 2105LA5MAP, 2205LA5021, 2205LA5MAP, 2305LA5021, 2305LA5MAP Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2022-028) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fourth consecutive year, LDH lacked adequate internal controls over eligibility determinations in the Medicaid and CHIP programs for the state fiscal year ending June 30, 2023. From a population of 81,874,016 Medicaid Per-Member-Per-Month (PMPM) and fee-for-service (FFS) payments totaling $13.1 billion, a non-statistical sample of 60 Medicaid payments were selected and the corresponding recipient’s eligibility was tested to ensure compliance with eligibility federal regulations. Seventeen (28%) out of 60 payments tested did not have adequate documentation to support the eligibility determination or redetermination within the recipient’s case record. The following errors were noted for Medicaid: • For one payment, LDH personnel did not discontinue coverage on a recipient who moved out of state. • For one payment, LDH personnel did not perform all required eligibility determinations before enrolling the recipient; therefore, the recipient was invalidly enrolled during fiscal year 2023. • For one payment, LDH did not perform all required eligibility determinations before transitioning the recipient to another Medicaid Group. • For 14 payments, renewals were not performed for the recipients during the state fiscal year as required by federal regulations. In addition, from a population of 6,352,535 CHIP PMPM and FFS payments totaling $527.9 million, a non-statistical sample of 60 CHIP payments was selected and the corresponding recipient’s eligibility was tested to ensure compliance with eligibility federal regulations. Fifteen (25%) out of 60 payments tested did not have adequate documentation to support the eligibility determination or redetermination within the recipient’s case record. The following errors were noted for CHIP: • For one payment, LDH personnel did not discontinue coverage on a recipient that was invalidly enrolled prior to the start of the Public Health Emergency (PHE). • For one payment, LDH personnel did not discontinue coverage on a recipient who became ineligible during the fiscal year due to enrollment in a separate CHIP program. • For 13 payments, LDH did not follow policies and procedures regarding documentation of renewals. Finally, in an audit report issued in August of 2023 by the Louisiana Legislative Auditor’s Performance Audit Services titled Medicaid Residency, it was discovered that LDH failed to discontinue coverage for four Medicaid recipients who moved out of state. Criteria: 42 CFR 431, 42 CFR 435, and 42 CFR 457 require that in order to be considered eligible, a recipient must meet eligibility factors and the recipient case record must include facts to support the agency’s eligibility decision. 42 CFR 435 and 457 also require annual renewal of eligibility. 42 CFR 433.400 also states in order to claim the temporary increase in the federal medical assistance percentage, states must maintain the Medicaid enrollment of “validly enrolled beneficiaries” in one of three tiers of coverage. States may terminate individuals not validly enrolled. Per State Health Official Letter #21-007, the 12-month postpartum continuous eligibility period is not available to beneficiaries enrolled under the unborn child option (separate CHIP program). In addition, per CMS guidance in the planning COVID-19 FAQs, "The requirements in sections 6008(b)(1) and (b)(2) of the Families First Coronavirus Response Act (FFCRA) to maintain eligibility and premiums in the FFCRA do not apply to separate CHIPs." LDH has outlined eligibility criteria and documentation to support determinations and renewals in its Medicaid eligibility manual. Cause: LDH did not adhere to established control procedures to ensure case records support eligibility decisions, including performance of annual renewals, per federal regulations and the Medicaid eligibility manual. Effect: Proper eligibility determination and renewals are critical to ensuring appropriate service eligibility, appropriate premium payments, and appropriate federal match rate on expenditures. Questioned costs totaling $217,026 in federal funds in relation to the Medicaid recipients who moved out of the state or were invalidly enrolled. We did not note any questioned costs related to the other errors due to certain restrictions on eligibility actions during the PHE. Questioned costs totaling $15,249 in federal funds in relation to the two CHIP recipients whose coverage was not discontinued. We did not note any questioned costs related to the other errors due to certain restrictions on eligibility actions during the PHE. Recommendation: LDH should ensure its employees follow procedures relating to eligibility determinations and redeterminations in the Medicaid and CHIP programs to ensure the case records support the eligibility decisions. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-27). Auditor’s Additional Comments: LDH noted in its response it did not concur with the errors noted for renewals not performed for both Medicaid and CHIP. LDH stated, “During the PHE, LDH was operating under a March 25, 2020 CMS approved waiver for certain flexibilities in meeting the timeliness of Medicaid renewals. LDH used the flexibility to suspend processing of standard renewals.” While CMS granted flexibilities for completing the renewals at a future date, it did not appear that CMS was granting approval for suspension of renewals. CMS also notified LDH that federal regulation requires the agency to document the reason for the delay in each case record, but there was no evidence of this in the exceptions noted above.

2023-025 - Noncompliance with and Inadequate Controls over Maternity Kick Payments Award Years: 2022, 2023 Award Numbers: 2205LA5021, 2205LA5MAP, 2305LA5021, 2305LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH did not adhere to established policies and procedures regarding maternity kick payments for fiscal year 2023. Maternity kick payments are one-time payments made by LDH to reimburse the Healthy Louisiana Managed Care Organizations (MCOs) for the costs associated with pre- and post-partum maternal care, as well as the delivery event itself. These payments are to be paid to the MCO upon submission of satisfactory evidence of the event or treatment which is referred to as a triggering event. During the period July 1, 2022, through June 30, 2023, LDH paid out 31,571 Medicaid program maternity kick payments totaling $385 million of state and federal funds to the Healthy Louisiana MCOs. In our review of all Medicaid maternity kick payments, we identified 101 kick payments totaling $887,955 in federal funds that were paid to the Healthy Louisiana MCOs with no triggering event as of June 30, 2023. During the period July 1, 2022, through June 30, 2023, LDH paid out 4,909 CHIP maternity kick payments totaling $55 million of state and federal funds to the Healthy Louisiana MCOs. In our review of all CHIP maternity kick payments, we identified 9 kick payments totaling $79,182 in federal funds that were paid to the Healthy Louisiana MCOs with no triggering event as of June 30, 2023. Criteria: Louisiana Administrative Code Title 50, Part I, Section 3509(A)(5) states MCOs may be reimbursed a one-time supplemental lump sum payment, referred to as a kick payment. The kick payment is intended to cover the cost of a specific care event or treatment. Payment will be made to the MCO upon submission of satisfactory evidence of the event or treatment under Title XIX to the Social Security Act. In accordance with this guidance, LDH policies require a triggering event to occur before a maternity kick payment can be made. LDH procedures also require that a review of kick payments be performed annually. Cause: LDH did not adhere to the established policies and procedures regarding maternity kick payments and their annual review process. In previous years, LDH had procedures in place to perform periodic ad hoc reviews of kick payments that were no longer supported by a triggering event due to the original event having been voided by the plan. It was determined that LDH and the Medicaid Fiscal Intermediary have not performed this annual process since December of 2021. Effect: There is an increased risk that maternity kick payments are being paid to Healthy Louisiana MCOs for triggering events that may not have taken place or no longer have satisfactory supporting evidence. Recommendation: LDH should strengthen existing policies and procedures to ensure the Medicaid Fiscal Intermediary is reviewing all maternity kick payments to ensure they are supported with a triggering event. When payments are identified that are no longer supported by satisfactory evidence, LDH should ensure the payments are recouped from the provider. Management’s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-30). Auditor’s Additional Comments: LDH noted in its response that it disagreed on the number of unsupported kick payments. As noted in the finding, the maternity kick payments did not have a triggering event as of June 30, 2023. The 35 kick payments mentioned in Management’s response had trigger events submitted after June 30, 2023, which is outside the audit period.

2023-026 - Noncompliance with Managed Care Provider Enrollment and Screening Requirement Award Years: 2022, 2023 Award Numbers: 2205LA5021, 2205LA5MAP, 2305LA5021, 2305LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2022-029) See Schedule of Findings and Questioned Costs for chart/table Condition: For the sixth consecutive year, LDH did not enroll and screen all Healthy Louisiana managed care providers and dental managed care providers as required by federal regulations. In our review of the 28,733 providers paid during fiscal year 2023, it was determined that 8,183 (28%) of managed care and dental managed care providers were not enrolled and screened in accordance with federal regulations. Criteria: 42 CFR 438.602 (2016 Managed Care Final Rule) and Section 5005 of the 21st Century Cures Act require that the enrollment process include providing the Medicaid agency with the provider’s identifying information including the name, specialty, date of birth, Social Security number, national provider identifier, federal taxpayer identification number, and state license or certification number of the provider. Additionally, the state agency is required to screen enrolled providers, require certain disclosures, provide enhanced oversight of certain providers, and comply with reporting of adverse provider actions and provider terminations. By using the federally required process, managed care providers must participate in the same screening and enrollment process as Medicaid and CHIP fee-for-service providers. Cause: In July 2021, LDH launched the enrollment portal created by Gainwell, the state’s current provider enrollment vendor. Although the enrollment portal was launched in fiscal year 2022, LDH gave providers until December 31, 2022, to enroll. Providers then had their claims denied for dates of service on or after January 1, 2023, if they had not enrolled through the enrollment portal. These deadlines followed LDH’s corrective action plan from fiscal year 2022; however, due to the timing of the deadlines, not all of the Healthy Louisiana managed care providers and dental managed care providers that received payments in fiscal year 2023 were enrolled and screened. Effect: LDH cannot ensure the accuracy of provider information obtained from the Louisiana Medicaid managed care plans and cannot ensure compliance with enrollment requirements defined by law and the Medicaid and CHIP state plan. Recommendation: LDH should ensure all providers are screened and enrolled as required by federal regulations. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-32).

2023-027 - Weakness in Controls over and Noncompliance with Provider Overpayments Award Years: 2022, 2023 Award Numbers: 2205LA5021, 2205LA5MAP, 2305LA5021, 2305LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2022-031) See Schedule of Findings and Questioned Costs for chart/table Condition: LDH did not have adequate controls in place to correctly identify the date of discovery for provider overpayments and, for the second consecutive year, did not provide sufficient appropriate audit evidence of compliance with federal regulations regarding the return of the federal portion of provider overpayments to the CMS in the appropriate quarter. In a non-statistical sample of 60 provider overpayments, LDH only provided supporting documentation for seven. As a result, we did not have the evidence to support whether LDH had correctly identified the date of discovery or properly returned overpayments to CMS. Criteria: Pursuant to 1903(d)(2)(c) of the Act (42 USC 1396b), states have up to one year from the date of discovery of the overpayment to recover or attempt to recover the overpayment from the provider before the federal share must be refunded to CMS via the CMS federal expenditure quarterly report, regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier. According to 42 CFR Part 433.316(c), the date of discovery is the earliest of the date on which any Medicaid agency official or other state office first notifies a provider in writing of an overpayment, the date on which a provider initially acknowledges a specific overpaid amount in writing to the Medicaid agency, or the date on which any state office or fiscal agent of the state initiates a formal action to recoup a specific overpaid amount from a provider without having first notified the provider in writing. Cause: LDH did not provide proper supporting documentation for the auditor to test federal regulations over provider overpayments. In addition, LDH’s controls were not suitably designed to correctly identify the date of discovery for provider overpayments. Effect: By not appropriately identifying the date of discovery as defined by federal regulations, LDH cannot ensure that the federal share of provider overpayments that reach their one-year period are returned to CMS in the appropriate quarter. Recommendation: LDH should ensure they are able to provide supporting documentation timely for the amounts reported in the quarterly CMS reports for provider overpayments. In addition, LDH should strengthen internal controls to ensure identification of the correct date of discovery for provider overpayments and compliance with federal regulations regarding the timely return of those overpayments. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-34).

2023-028 - Inadequate Controls over Payroll Award Year: 2023 Award Numbers: NU62PS924522, NU90TP922016 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: Yes (Prior Year Finding No. 2022-004) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fourth consecutive year, the Louisiana Department of Health, Office of Public Health (OPH) did not ensure payroll expenditures were certified and approved for the Public Health Emergency Preparedness program and the HIV Prevention Activities Health Department Based program. Exceptions for each federal program are as follows: • For the Public Health Emergency Preparedness program, a non-statistical sample of 60 payroll transactions was tested from a population of 1,553 transactions totaling $4,760,920. One (2%) time statement was not certified by the employee, and four (7%) time statements were not approved by the employees’ supervisors. • For the HIV Prevention Activities Health Department Based program, a non-statistical sample of 120 payroll transactions was tested from a population of 1,015 transactions totaling $434,661. Two (2%) time statements were not certified by the employees, and three (3%) time statements were not approved by the employees’ supervisors. Criteria: 2 CFR 200.430(i) states that records must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Furthermore, the records must comply with the established accounting policies and practices of the non-federal entity. The Division of Administration Personnel Policy No. 99 requires employees and supervisors to certify and/or approve time statements for accuracy. Timekeepers are responsible for reviewing the LaGov ZP241 eCertification report prior to processing to identify any employees who have not certified their time statements and any supervisors who have not approved their staff’s time statements. Cause: OPH lacked sufficient controls to ensure electronic time statements were properly certified and approved in accordance with federal and state regulations. Effect: Failure to adequately approve program expenditures increases the risk that unallowable costs could be reimbursed by the federal grantor. Recommendation: OPH should ensure employees comply with existing policies and procedures, including properly certifying and approving electronic time statements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-36).

2023-029 – Noncompliance and Weakness in Controls with Special Tests and Provisions Requirements Award Years: Various Award Numbers: Various Compliance Requirement: Special Tests and Provisions Pass-Through Entities: Various Repeat Finding: Yes (Prior Year Finding No. 2022-034) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fifth consecutive year, LSUHSC-S did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. We reviewed a non-statistical sample of 12 federal R&D Cluster awards from a population of 58 awards, plus two additional awards based on materiality, for the fiscal year ending June 30, 2023. We reviewed the biannual Time and Effort Certification forms, as applicable, for each award and the 24 key personnel assigned to the selected awards. We noted two of 24 (8%) key personnel had documentation of actual effort on the Time and Effort Certification forms that did not agree to the effort reported to the federal grantor, and there was no evidence of prior approval from the federal grantor for a change in key personnel. Criteria: 2 CFR 200.308(c) states that for non-construction federal awards, recipients must request prior approvals from federal awarding agencies for one or more of the following program or budget-related reasons: (i) change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval); (ii) change in a key person specified in the application or the federal award; (iii) the disengagement from the project for more than three months, or a 25% reduction in time devoted to the project, by the approved project director or principal investigator. Cause: LSUHSC-S’s controls are not effectively designed to ensure prior approval is obtained for changes in effort by key personnel as required by federal regulations, specifically relating to disengagement from a project for more than three months or a 25% reduction in effort. This is partially due to LSUHSC-S revising their Time and Effort Certification policy in September 2022, which changed the frequency of the certification from quarterly to semiannually. Effect: Failure to implement controls over key personnel requirements could result in noncompliance with Special Tests and Provisions requirements. Recommendation: Management should monitor changes in effort for key personnel and verify that prior written approval is obtained from the federal grantor for changes that exceed the thresholds set in federal regulations. Management should revise the Time and Effort Certification policy or implement alternative controls designed to ensure compliance with Special Tests and Provisions requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-40).

2023-030 - Weakness in Controls over Payroll Award Years: 2022, 2023 Award Numbers: 2204LADI00, 2304LADI00 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: DCFS did not follow established payroll policies and procedures for the certification and approval of time statements, as well as for the approval of leave requests. This is the second consecutive year a weakness in controls over payroll has been reported. In our review of 45 time statements department-wide for the period July 1, 2022, through June 30, 2023, we identified the following: • Ten (22%) time statements were approved by supervisors between 1 and 252 days after the date required by policy. • Three (7%) time statements were certified by employees between 20 and 70 days after the date required by policy. • Two (4%) time statements were not certified by employees nor approved by the supervisors prior to payroll processing. In addition, our review of payroll system reports identified 8,133 (5%) of 156,777 leave requests that were auto-approved by the system. This occurs when leave has been requested, but the employee’s supervisor did not take timely action to approve/reject the system leave request before the end of the pay period in which the leave was taken. All open leave requests in the system will be auto-approved on the last day of the applicable pay period in order for the employee to receive payment. We also performed procedures specifically on the Disability Insurance/SSI Cluster, a major federal program for fiscal year 2023. In a statistical sample of 40 payroll transactions from a population of 46,568 Disability Insurance/SSI Cluster payroll transactions totaling $19,646,061, three (8%) of the time statements tested were not approved by the employees’ supervisors. Criteria: DCFS payroll policy requires employees to certify their time statements by the Tuesday following the close of the pay period in the Cross-Application Time Statements (CATS) system, and supervisors are required to approve time statements in the CATS system by the Wednesday following the close of the pay period. Supervisors are also responsible for approving or rejecting all leave requests before the end of the applicable pay period. Also, 2 CFR 200.430(i)(1)(i) requires that charges to federal awards for salaries and wages must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Cause: DCFS employees did not adhere to the established policies and procedures over payroll to certify and approve time statements in a timely manner or properly approve leave requests. Effect: As a result, there is an increased risk that errors and/or fraud could occur and not be detected in a timely manner and that unallowable costs could be reimbursed by the federal grantor. Recommendation: Management should ensure employees comply with existing policies and procedures, including certifying and approving time statements and leave requests in a timely manner. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-6).

2023-031 – Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act Award Years: 2020 - 2022 Award Numbers: EMT-2020-FM-053, EMT-2020-FM-E004, EMT-2021-FM-024, EMT-2021-FM-E001, EMT-2022-FM-E001 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Governor’s Office of Homeland Security and Emergency Preparedness (GOHSEP) did not comply with the Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Flood Mitigation Assistance program. As of June 30, 2023, GOHSEP had not entered subaward information into the FFATA Subaward Reporting System (FSRS) for any of the 50 subawards of $30,000 or more totaling $125,920,379, related to five separate federal awards. Criteria: 2 CFR Part 170 Appendix A(I)(a) requires the non-federal entity to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity into the FSRS no later than the end of the month following the month in which the obligation was made. Cause: GOHSEP management indicated that the noncompliance occurred due to having limited access to the FSRS to enter the awards meeting the requirement. Effect: Not reporting obligating actions to FSRS prevents the public from having access to accurate information on how GOHSEP is obligating federal funds. Recommendation: GOHSEP should strengthen internal controls to ensure that appropriate personnel have the necessary access to FSRS and are timely entering the required award information for FFATA reporting in accordance with federal requirements. Management’s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-15).

2022-004 - Inadequate Controls over PayrollAward Year: 2022Award Numbers: 6LA700503, NU50CK000532, NU62PS924522, NU62PS924620, NU90TP922016Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost PrinciplesRepeat Finding: Yes (Prior Year Finding No. 2021-005)See Schedule of Findings and Questioned Costs for chart/tableCondition:The Louisiana Department of Health, Office of Public Health (OPH) did not ensure payroll expenditures were timely certified and approved for the WIC Special Supplemental Nutrition Program for Women, Infants, and Children; the Public Health Emergency Preparedness program; the Epidemiology and Laboratory Capacity for Infectious Diseases program; and the HIV Prevention Activities Health Department Based program. This is the third consecutive year payroll internal control deficiencies have been reported for Public Health Emergency Preparedness program and HIV Prevention Activities Health Department Based program, and the second consecutive year for WIC Special Supplemental Nutrition Program for Women, Infants, and Children and Epidemiology and Laboratory Capacity for Infectious Diseases program. Exceptions for each federal program are as follows:? For the WIC Special Supplemental Nutrition Program for Women, Infants, and Children, a non-statistical sample of 60 payroll transactions was tested from a population of 6,184 transactions totaling $8,970,425. Five (8%) time statements were not timely approved by the employees? supervisor, of which two (3%) were not approved at all, and two (3%) were not certified timely by the employees ranging from 13 to 236 days after the posting date.? For the Public Health Emergency Preparedness program, a non-statistical sample of 60 payroll transactions was tested from a population of 1,394 transactions totaling $3,988,398. Twenty-one (35%) time statements were not timely approved by the employees? supervisors, of which 12 (20%) were approved ranging from 23 days to 447 days after posting date and seven (12%) were not approved at all; two (3%) were not certified by the employees; and two (3%) were approved before certified.? For the Epidemiology and Laboratory Capacity for Infectious Diseases program, a non-statistical sample of 60 payroll transactions was tested from a population of 3,933 transactions totaling $5,190,684. Nine (15%) time statements were not timely approved by the employees? supervisors, of which four (7%) were not approved at all; one (2%) was not certified by the employee; and one (2%) was approved before certified.? For the HIV Prevention Activities Health Department Based program, a non-statistical sample of 60 payroll transactions was tested from a population of 1,024 transactions totaling $386,769. Nine (15%) time statements were not timely approved by the employees? supervisors, of which one (2%) was not approved at all; seven (12%) were approved ranging from one day to 351 days after the posting date; and one (2%) was not certified by the employee.Criteria:2 CFR 200.430(i) requires that records must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Furthermore, the records must comply with the established accounting policies and practices of the non-federal entity.The Division of Administration Personnel Policy No. 99 requires employees and supervisors to certify and/or approve time statements for accuracy by 10:00 p.m. on the Wednesday following the close of the pay period. Time administrators are responsible for reviewing the LaGov ZP241 eCertification report prior to processing to identify any employees who have not certified their time statements and any supervisors who have not approved their staff?s time statements.Cause:OPH lacked sufficient controls to ensure electronic time statements were properly certified and approved prior to the posting date in accordance with federal and state regulations.Effect:Failure to adequately approve program expenditures increases the risk that unallowable costs could be reimbursed by the federal grantor.Recommendation:OPH should ensure employees comply with existing policies and procedures, including certifying and approving electronic time statements in a timely manner.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a corrective action plan (B-43).

2022-005 - Noncompliance with and Weakness in Controls over Federal Research and Development ExpensesAward Years: VariousAward Numbers: VariousCompliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost PrinciplesPass-Through Entities: VariousRepeat Finding: Yes (Prior Year Finding No. 2021-007)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fourth consecutive year, Louisiana State University Health Sciences Center in Shreveport (LSUHSC-S) did not ensure internal control over documentation of personnel services were operating effectively, and did not ensure compliance with federal guidance regarding cost transfers applicable to the Research and Development (R&D) Cluster. In addition, LSUHSC-S did not ensure that costs charged to federal awards were allowable in accordance with federal regulations and the terms and conditions of the award when requesting reimbursement.In a non-statistical random sample of 50 out of 10,798 expense transactions charged to R&D during the fiscal year ending June 30, 2022, the following exceptions were noted:? Three (6%) purchasing card (P-Card) transactions were not allowable in accordance with federal regulations and the terms and conditions of the award and are considered questioned costs totaling $1,073.? For five (10%) of 50 transactions tested, LSUHSC-S overstated expenses on the Schedule of Expenditures of Federal Awards because the award was fully funded, and expenses in excess of the award amount were not removed from the project used to identify expenditures to federal awards in the accounting records, or the expense was determined not allowable as noted above.? Seven (35%) of 20 time and effort certifications for salary and related benefit expenses tested were completed 119 to 461 days after the end of the quarter.We performed an analysis of payroll adjusting journal entries to record cost transfers to and/or from R&D awards. We noted that 838 (51%) out of 1,654 adjusting journal entries were made more than 90 days after the end of the quarter from the original transactions. The adjustments were made 97 to 1,026 days after the original transactions were recorded and 96 to 953 days after the end of the quarter.In a non-statistical random sample of 10 out of 1,654 payroll adjusting entries affecting R&D, tested by employee, project id (related to federal award), and journal id, six (60%) adjustments did not have adequate documentation for cost transfers to fully explain how the error occurred and a sufficient explanation to support the correctness of the new charge. Two of these adjusting entries added costs to the federal award projects and are considered questioned costs totaling $28,324.Criteria:2 CFR 200.430(i)(1)(i) requires that charges to federal awards for salaries and wages must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Per 2 CFR 200.430(i)(1)(viii), budget estimates alone do not qualify as support for charges to federal awards, but may be used for interim accounting purposes, provided that significant changes in work activity are identified and entered into the records in a timely manner and the non-federal entity?s system of internal controls includes processes to review after-the-fact charges and make necessary adjustments.Per LSUHSC-S?s Time and Effort Certification Policy and Procedures, LSUHSC-S utilizes time and effort certifications to support salary charges to sponsored projects as an after-the-fact certification of effort of all individuals when all or a portion of their salaries are charged to a sponsored project. Based on LSUHSC-S?s policy, time and effort certifications should be completed within approximately 90 days of the end of the quarter. Management interprets the end of the quarter to be when the time and effort reports are sent to the departments once the last month of the quarter is closed in the accounting system. If there is a substantial (5% or more) difference between the salary charges and the effort actually expended by the individual on projects during the quarterly reporting period, a payroll reallocation must be created within 30 days.Per 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award. These internal controls should be in compliance with guidance in the ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission. Per the Standards for Internal Control in the Federal Government, examples of common categories of control activities include accurate and timely recording of transactions.In addition, the National Institute of Health (NIH) is the grantor for the majority of the LSUHSC-S?s R&D grant awards. Per the NIH Grants Policy Statement 7.5, cost transfers that represent corrections of clerical or bookkeeping errors should be accomplished within 90 days of when the error was discovered. The transfers must be supported by documentation that fully explains how the error occurred and a certification of the correctness of the new charge by a responsible organizational official. An explanation merely stating that the transfer was made ?to correct error" or "to transfer to correct project" is not sufficient. Transfers of costs from one project to another or from one competitive segment to the next solely to cover cost overruns are not allowable.2 CFR 200 Subpart E and the terms and conditions of the award establish requirements for non-federal entities receiving federal awards that govern the allowability of costs.Cause:LSUHSC-S?s approval of P-Card transactions did not provide sufficient review of the allowability of expenses on federal awards. LSUHSC-S has procedures in place to review expenses prior to requesting reimbursement; however, it did not ensure that the necessary adjustments were made to the accounting system in a timely manner for expenses that were not allowed for reimbursement. In addition, training to emphasize accountability and the importance of completing time and effort certifications timely and accurately per policy was not completed as planned during fiscal year 2022 due to staffing shortages.LSUHSC-S is still in the process of implementing the corrective action outlined in the prior year to include documentation of adjusted effort and questions to address justification for the adjustment, errors, and timeliness on a modified Personnel Change form.Effect:Untimely certifications and the untimely discovery and correction of errors increases the risk of inaccurate reporting and may result in an inability to complete approved projects within the approved budget and/or period of performance. As a result, LSUHSC-S may have to utilize university funds to complete approved projects.In addition, inadequate controls and noncompliance with federal awards increases the likelihood of disallowed costs, which LSUHSC-S may have to repay to the federal grantor.Recommendation:Management should monitor time and effort certifications completed by the departments and investigate and obtain justification from department personnel for untimely certifications, as well as untimely adjustments and lack of supporting documentation for adjustments to enforce established policies. Management should ensure adequate design and operating effectiveness of controls over expenses, including P-Card expenses, charged to federal awards to verify allowability of costs in accordance with federal requirements and grant terms and conditions prior to requesting reimbursement. Management should also consider implementing other complementary controls such as preventing costs from being charged to projects in the accounting system beyond the approved budget or period of performance.Management?s Response and Corrective Action Plan:Management concurred with the finding and outlined a plan of corrective action (B-52).

2022-006 - Control Weakness and Noncompliance with Personnel Expenses Charged to Federal AwardsAward Years: 2018, 2019, 2021, 2022Award Numbers: 2138930, 2000614536, B-18-DP-22-001, EMW-2020-SS-00011-S01, M19AC00015, NR227217XXXXC002, P01AI048240, R21AI165939, R33HD099745, U19AI159840Compliance Requirements: Allowable Costs/Cost Principles, Special Tests and ProvisionsPass-Through Entities: Board of Trustees of the Leland Stanford Junior University, Emory UniversityRepeat Finding: Yes (Prior Year Finding No. 2021-009)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the second consecutive year, the University of Louisiana at Lafayette (UL Lafayette) did not have adequate controls in place to ensure personnel expenses and effort charged to federal R&D awards accurately reflected work performed. From a population of 28,744 payroll and non-payroll expenses charged to R&D grants, a non-statistical sample of 25 transactions was tested. For all 12 (48%) of the payroll transactions, UL Lafayette was unable to provide documentation to show that personnel-related expenses, totaling $4,520, were supported by time and effort certifications to ensure the accuracy of budget estimates charged to federal awards as required by federal regulations. Additionally, because there is no after-the-fact review to ensure the accuracy of personnel costs and effort charged to the awards, UL Lafayette could not ensure compliance with the requirements of special tests and provisions related to key personnel effort.Criteria:2 CFR 200.430(i) specifies the documentation standards for personnel expenses. In order to be allowable, charges to federal awards for personnel expenses must be based on records that accurately reflect the work performed and must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Budget estimates alone do not qualify as support for charges to federal awards, but can be used for interim accounting purposes provided that internal controls include an after-the-fact review to confirm the accuracy of final amounts charged to federal awards.Prior approval requirements related to key personnel effort are contained in 2 CFR 200.308(c) and within grant terms and conditions. A reduction of 25% or greater in time devoted to the project from key personnel requires prior approval.Cause:Management represented that it?s still in the process of implementing the prior-year corrective actions to address the issues noted in the prior-year finding. As a result, time and effort certifications were not completed by employees to support the accuracy of budget estimates charged to federal awards as required by 2 CFR 200.430(i).Effect:Inadequate controls related to federal documentation standards for personnel expenses could result in noncompliance with federal allowable costs and cost principles, as well as noncompliance with special tests and provisions related to key personnel effort.Recommendation:Management should strengthen internal controls to ensure that personnel expenses charged to the federal awards are supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated.Management?s Response and Corrective Action Plan:Management did not concur with the finding, noting it did not have sufficient time in fiscal year 2022 for corrective action and provided its progress on addressing the finding (B-82).

2022-007 - Noncompliance with Subrecipient Monitoring RequirementsAward Years: 2018, 2020 - 2022Award Numbers: DUE-2044358, NA18OAR4170098, OIA-2019511, OIA-2119688Compliance Requirement: Subrecipient MonitoringRepeat Finding: Yes (Prior Year Finding No. 2021-010)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the second consecutive year, UL Lafayette did not adequately monitor subrecipients of the R&D Cluster programs. In a non-statistical sample of five subawards out of a population of 49 subawards, it was noted that for four (80%) of the subrecipients evaluated UL Lafayette was unable to provide documentation that ensured each subrecipient obtained the required audit or that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards. Additionally, for all five (100%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipients? risk of noncompliance with federal regulations and the terms of the subaward.Criteria:2 CFR 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring.Per 2 CFR 200.332(f), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR Part 200, subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in CFR 200.501 of $750,000 or more in federal awards during the subrecipient?s fiscal year.2 CFR 200.332(d)(2) requires that pass-through entities follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies provided to the subrecipient from the pass-through entities detected through audits, on-site reviews, and written confirmation from the subrecipient.2 CFR 200.332(d)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient?s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings.Cause:UL Lafayette management indicated that it was working on internal procedures to adequately monitor subrecipients as result of the prior-year finding. However, management has yet to finalize and apply these procedures on all active subrecipients.Effect:Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency.Recommendation:UL Lafayette should strengthen controls to ensure the timely review of all required subrecipient audit reports in order to evaluate the impact of any findings noted in the audits and issue management decision letters, if applicable. In addition, UL Lafayette should strengthen controls to ensure risk assessments are performed and documented on all subrecipients in accordance with federal regulations.Management?s Response and Corrective Action Plan:Management did not concur with the finding, noting it did not have sufficient time in fiscal year 2022 for corrective action and provided its progress on addressing the finding (B-83).

2022-008 ? Improper Employee Activity in Federal ProgramsAward Years: 2016 - 2022Award Number: 6LA400102Compliance Requirements: Allowable Costs/Cost Principles, EligibilityRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:The Department of Children and Family Services (DCFS), Fraud and Recovery Unit, identified improper activity by one employee who received benefits under the Supplemental Nutrition Assistance Program (SNAP) and by two employees who violated department policy as well as state law related to payroll.Three employees were cited for program or department policy violations as follows:? One former employee did not accurately report household members and accessed their own records in the DCFS system, resulting in improperly receiving $3,968 in SNAP benefits. The employee was cited for an intentional program violation and resigned in December 2022.? One former employee received wages from DCFS and another employer for the same hours worked during the period August 2016 through September 2020, resulting in a loss of $5,116 impacting various federal programs. The employee was terminated in July 2022.? One employee received wages from DCFS and another employer for the same hours worked during the period August 2021 through September 2022, resulting in a loss of $11,349 impacting various federal programs. DCFS is pursing disciplinary action against the employee.Criteria:DCFS Policy G-310 states that falsification of records consists of any deliberate act of annotating an activity which in fact differs factually from the activity that actually transpired.DCFS Policy 6-1 states that all staff members (state employees and contractors) are prohibited from taking any action on their personal case or on a case involving an immediate family member, friend, or social acquaintance of him/herself or his supervisor.7 CFR 273.16(c) defines intentional program violations as intentionally making a false or misleading statement; misrepresenting, concealing, or withholding facts; or committing any act that constitutes a violation of SNAP, SNAP regulations, or any state statute for the purpose of using, presenting, transferring, acquiring, receiving, possessing, or trafficking of SNAP benefits or Electronic Benefits Transfer (EBT) cards.DCFS Policy 4-2 states that Civil Service Rule 15.2 requires certification of payroll and attendance records by both an employee and his/her appointing authority or designee of hours actually worked and leave taken during a payroll period.Cause:The employees did not adhere to department policy and federal award requirements.Effect:Amounts not recouped by DCFS as of June 30, 2022, totaled $20,433 and represent questioned costs.Recommendation:Management should continue to investigate improper employee activities and emphasize the criminal consequences of such activities.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a corrective action plan (B-6).

2022-009 ? Inadequate Recovery of Small Rental Property Program LoansAward Years: 2006, 2007Award Numbers: B-06-DG-22-0001, B-06-DG-22-0002Compliance Requirement: EligibilityRepeat Finding: Yes (Prior Year Finding No. 2021-012)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fiscal year ended June 30, 2022, the Division of Administration, Louisiana Office of Community Development (LOCD) identified $2,635,609 in Small Rental Property Program (SRPP) loans for nine property owners under the Community Development Block Grant/State?s Program (CDBG) who failed to comply with one or more of their loan agreement requirements and were assigned to loan recovery status. Since LOCD has not recovered these loans, we consider these amounts totaling $2,635,609 to be questioned costs. In addition, 1,147 noncompliant loans identified in previous years totaling $104.5 million remain outstanding.As of June 30, 2022, of the 4,480 outstanding SRPP loans totaling $436.3 million, 993 noncompliant loans totaling $92.4 million are in active recovery status, and LOCD represented that current recovery efforts are to either recoup the loan funds or work with the applicants to bring them into compliance with the state?s continuing requirements of the program. The remaining 163 noncompliant loans totaling $14.7 million have been determined by LOCD to be uncollectable for various reasons such as foreclosure, property seizure, or legal dispute.Criteria:OMB Circular A-87, Cost Principles for State, Local, and Indian Tribal Governments (now located in 2 CFR 225) stipulates that the state assume responsibility for administering federal awards in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to hurricanes Katrina and Rita, the state was awarded and has allocated approximately $653 million to the SRPP, as part of the Road Home program. In accordance with the state?s U.S. Department of Housing and Urban Development (HUD)-approved Action Plan Amendment 24, the SRPP offers forgivable loans to qualified property owners who agree to offer rental properties at affordable rents to be occupied by lower-income households. In exchange for accepting loans ranging between $10,000 and $100,000 per rental unit, property owners are required to accept limitations on rents and incomes of renters during an ?affordability period,? a specified period of time based on the amount of funding received and the type of work being done (renovation or full construction) ranging between three and 20 years. The loan amounts are determined based on location of property, number of bedrooms, and the poverty level of the renter. In addition to accepting limitations on rents and income of renters, property owners also agree to maintain property insurance and maintain flood insurance, if necessary. These requirements become effective one year after the closing date and remain until the expiration of the ?affordability period.? According to the loan agreements, failure to comply with any of the loan requirements shall constitute default and mandatory repayment. Good internal controls would ensure that policies and procedures are in place with an established timeline to monitor compliance with the loan agreements and provide for specific actions (i.e., loan modification, foreclosure, or repayment) if a property owner fails to comply with the loan agreement or does not provide evidence of compliance as required by the loan agreement.Cause:In June 2016, HUD issued a monitoring review report with a finding that the SRPP design lacked sufficient fiscal accounting controls and procedures to ensure that CDBG funds identified as ineligible expenses are able to be recaptured and repurposed for eligible uses. Since that time, there have been several monitoring reports indicating progression in this area. In its July 2021 monitoring report, HUD stated that LOCD continued to make gradual progression through its current recapture and reclassification efforts to reduce its overall repayment amount. In its response to that report, LOCD provided an update on the status of the remaining noncompliant properties as it continues to work with HUD to identify a solution for these properties.Effect:Ultimately, LOCD?s failure to recover loans from noncompliant property owners could result in disallowed costs. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of the awards.Recommendation:LOCD should continue its monitoring to identify awards to be placed in recovery and continue the corrective actions as recommended by HUD to recover funds from noncompliant property owners.Management?s Response and Corrective Action Plan:LOCD stated in its response that it will continue the efforts to recover ineligible awards and will continue to work with rental property owners to become compliant and resolve loan compliance issues to reduce or eliminate the need to recapture funds from rental property owners (B-13).

2022-010 ? Restore Louisiana Homeowner Assistance Program Awards Identified for Grant RecoveryAward Year: 2016Award Number: B-16-DL-22-0001Compliance Requirement: EligibilityRepeat Finding: Yes (Prior Year Finding No. 2021-014)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fiscal year ended June 30, 2022, LOCD identified $121,650 in noncompliant Restore Louisiana Homeowner Assistance Program (RLHAP) awards for eight homeowners through established program implementation and monitoring procedures for the CDBG Program. Since LOCD has not recovered these noncompliant awards at year-end, we consider these amounts to be questioned costs. In addition, 36 noncompliant files totaling $644,913 identified in the previous years are still outstanding. LOCD is actively pursuing collections on the files.As of June 30, 2022, $666,587,500 in total RLHAP awards have been disbursed to 17,254 homeowners. LOCD is actively reviewing 38 files totaling $715,592 to make final determinations of the homeowner?s noncompliant status. At year-end, LOCD reported that 269 homeowner files totaling approximately $4.4 million have been reviewed through its monitoring procedures. Of the 269 homeowners, LOCD reported 82 homeowners were placed in recapture status, 148 homeowners were cleared through the review process, 15 homeowners returned their grant award, in whole or in part, and 24 homeowners entered into repayment plans.Criteria:2 CFR 200, Subpart E, Cost Principles, stipulates that the state assumes responsibility for administering federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award.In response to the March and August Floods of 2016, the state was awarded approximately $1.07 billion to administer RLHAP. In accordance with the state?s HUD-approved Action Plan, eligible homeowners must enter into grant agreements with the state which require homeowners to comply with program requirements in exchange for compensation to rehabilitate or reconstruct their damaged property. Homeowners have three program options to choose from based on their progress in the rebuilding process and their capacity to complete their home repair or reconstruction. Eligibility and grant award calculations are determined based on information provided by the homeowner, the results of field inspections, and available third-party datasets. Once eligibility has been established and award amounts have been calculated, funds are awarded to the homeowner upon the effective date of signing the grant agreement, which is referred to as the closing date. Should homeowners experience a change in the circumstances after grant determination or if additional information becomes available after closing, homeowners? grant calculation or program eligibility may change. In the event the change reduces their amount of eligible funding, RLHAP may require that a homeowner return all or a portion of their award.Cause:Circumstances that may result in homeowners being required to repay all or a portion of the award include: duplicative benefits received but not included in initial grant award calculation, information discovered identifying the homeowner as ineligible for the award received, failure to complete construction per program requirements, substantial noncompliance with requirements of grant agreements, voluntary withdrawal from the program, or discovery that the homeowner provided false or misleading information during the grant award process.Effect:If LOCD is unable to recover benefits from noncompliant homeowners, disallowed costs could result. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of these awards.Recommendation:LOCD should continue its monitoring to identify awards to be placed in recovery and continue recovery efforts to collect those awards determined to be noncompliant.Management?s Response and Corrective Action Plan:LOCD agreed that the identified files have been placed in recapture and stated it will continue to follow the established recapture procedures for these grant awards to ensure ultimate compliance (B-15).

2022-011 - Inadequate Controls over and Noncompliance with Subrecipient Monitoring RequirementsAward Years: 2019 - 2021Award Numbers: AA332321955A22, AA347712055A22, AA363222155A22Compliance Requirements: Activities Allowed or Unallowed, Subrecipient MonitoringRepeat Finding: Yes (Prior Year Finding No. 2021-019)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fourth consecutive year, the Louisiana Workforce Commission (LWC) did not adequately follow-up on subrecipient monitoring reports under the Workforce Innovation and Opportunity Act (WIOA) Cluster programs.Our review of LWC?s fiscal year 2022 monitoring reports, of fiscal year 2020, for all 15 of LWC?s subrecipients, disclosed the following:? Two monitoring reports were not issued timely by LWC. The monitoring reports were issued 74 and 75 days after the completion of the monitoring review. LWC?s policy requires monitoring review reports to be issued 60 days after the completion of the monitoring review.? For four monitoring reports, close out letters were issued 145 to 191 days after monitoring report issuance. For six monitoring reports, close out letters were not issued as of January 2023, while the monitoring reports for these reviews were issued more than 200 days prior. The monitoring reports include findings with possible questioned costs totaling $3.1 million. LWC policy does not specifically address timeliness requirements for close out letters.In a non-statistical random sample of five of 15 subrecipient working papers, we noted the following:? Three subrecipients had findings on the monitoring reports stemming from a lack of documentation supporting the subrecipients? drawdowns of WIOA funds, and drawdowns of federal funds could not be reconciled by LWC to the subrecipients accounting records. The monitoring reports noted potential questioned costs associated with these drawdowns. These reviews are included in the six monitoring reports not issued as of January 2023, noted in the bullet above. Timely resolution would allow LWC to quickly address any compliance issues at the subrecipient level. According to LWC, it is working with the subrecipients to reconcile the federal funds drawdowns and close out the reports.Criteria:2 CFR 200.332(d) requires that pass-through entities monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals.2 CFR 200.332(d)(2) requires that pass-through entities follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies provided to the subrecipient from the pass-through entities detected through reviews.Annual monitoring reviews are required on all subrecipients for compliance with federal requirements. The review includes a review of LWC federal drawdowns for subrecipient expenditures. LWC fiscal relies on the monitoring section to review the drawdown documentation at the subrecipient to ensure that drawdowns are adequately supported.20 CFR 683.410 requires pass-through entities to issue management decisions (reports) on applicable findings and follow-up to ensure subrecipients take prompt and appropriate action on all audit findings.LWC?s Policy Number OWD 4-12 requires monitoring reviews to be issued within 60 days of completion of the monitoring review.Cause:LWC did not follow established policy for timely issuance of monitoring reports. LWC policy does not specifically address timeliness requirements for issuing close out letters.Effect:Failure to timely resolve documentation and questioned costs impairs LWC?s ability to ensure that program funds passed through to its subrecipients were spent in accordance with program regulations and increases the risk of improper payments, which LWC may have to repay to the federal grantor. WIOA program expenditures totaled $56.5 million during state fiscal year 2022, with approximately $46 million provided to subrecipients.Recommendation:LWC management should ensure that subrecipient monitoring reports are issued in a timely manner in accordance with LWC policy. LWC management should develop and implement policy ensuring timely and adequate close out of monitoring reviews.Management?s Response and Corrective Action Plan:Management concurred in part with the finding and provided a corrective action plan (B-59).

2022-012 - Inadequate Controls over and Noncompliance with Unemployment Insurance Benefits RequirementsAward Year: Not ApplicableAward Number: Not ApplicableCompliance Requirements: Activities Allowed or Unallowed, EligibilityRepeat Finding: Yes (Prior Year Finding No. 2021-008)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the third consecutive year, LWC did not have adequate internal controls and did not comply with requirements of the Unemployment Insurance (UI) federal program. LWC issued more than $681 million in benefit payments to more than 260,000 claimants during fiscal year 2022.In December 2020, Congress passed the Continued Assistance for Unemployed Workers Act of 2020 (CAA), which extended many of the UI-related provisions in the Coronavirus Aid, Relief, and Economic Security (CARES) Act and also required claimants to provide supporting documents to verify income and identity, if receiving Pandemic Unemployment Assistance (PUA). Federal funding for the pandemic benefits ended after July 2021.In a non-statistical random sample of 60 claimants who were paid $188,180 in unemployment benefits in fiscal year 2022, we identified errors for 16 claimants, which resulted in questioned costs totaling $30,704. One claimant file contained multiple errors.For 13 (22%) out of 60 UI claimants, claimant files did not support monetary eligibility.? 12 claimant files did not have required wage documentation. CAA required all claimants receiving federal assistance payments after December 27, 2020, to provide evidence of self-employment earnings in order to remain eligible for PUA. According to LWC, a waiver has been requested from the U.S. Department of Labor from this requirement; as of March 21, 2023, LWC has not received a waiver.? One claimant file did not have evidence of child support payments properly withheld from the benefit payment by LWC as instructed by the child support order in the claimant file.For four (7%) out of 60 UI claimants, claimant files did not support non-monetary eligibility.? Four claimant files did not include required claimant identification. CAA requires states to verify the identity of PUA applicants whose identities were not previously verified on an Unemployment Compensation (UC), Extended Benefits (EB), or Pandemic Emergency Unemployment Compensation (PEUC) claim within the last 12 months.Criteria:Claimant files are required to contain certain information, including wage documentation and claimant identification to support eligibility for benefits paid under the PUA program. Upon notification from DCFS, child support court orders must be followed. Louisiana Revised Statute 23:1693 requires child support to be deducted from unemployment compensation when notified by DCFS.2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards.Cause:LWC failed to obtain needed documentation.Effect:Failure to obtain personal identifying information and wage documents results in noncompliance with federal program requirements and increases the risk of overpayments. Failure to properly withhold child support payments as ordered by a court results in noncompliance with state laws.Recommendation:LWC should strengthen controls to ensure all required documentation is obtained. In addition, LWC should take the necessary actions to ensure court ordered child support deductions are setup timely to ensure compliance with applicable laws.Management?s Response and Corrective Action Plan:Management concurred in part with the finding and provided a corrective action plan (B-72).Auditor?s Additional Comments:LWC noted in its response that a blanket waiver of overpayments resulting from the implementation of the proof of employment requirement has been requested; however, as noted in the finding and LWC?s response, the waiver has not yet been approved. LWC disagrees with the LLA?s interpretation of the identity verification requirements. The CAA provisions for identification verification noted above should be applied unless specific guidance is received from the federal grantor stating otherwise. Per CAA, states that previously verified an individual?s identity on a UC, EB, or PEUC claim within the last 12 months are not required to re-verify identity on the PUA claim. There was no evidence of verified identification in the claimant files for the errors noted. LWC remains responsible for administering the UI program with adequate internal controls to ensure compliance with federal requirements.

2022-013 - Higher Education Emergency Relief Fund Reporting WeaknessesAward Year: 2022Award Numbers: P425E201230, P425F201239, P425L200162Compliance Requirement: ReportingRepeat Finding: Yes (Prior Year Finding No. 2021-023)See Schedule of Findings and Questioned Costs for chart/tableCondition:Baton Rouge Community College (BRCC) did not ensure compliance with certain reporting requirements as established by the U.S. Department of Education (USDOE) for the Higher Education Emergency Relief Fund (HEERF) program.Based on our review of the four quarterly reports and the annual report, the following errors in reporting were identified:? BRCC incorrectly publicly posted the Quarterly Public Reporting for Institutional and Minority Serving Institutions (MSI) portions for the quarter ending September 30, 2021, as the report for the quarter ending December 31, 2021. BRCC subsequently publicly posted the correct report after auditor inquiry, 289 days after the required due date.? The Quarterly Public Reporting for Student Aid Portion for the quarters ending September 30, 2021, and December 31, 2021, were publicly posted 117 and 25 days, respectively, after the required due dates.? The Annual Report for the calendar year ending December 31, 2021, did not accurately report the number of students that received HEERF emergency financial aid grants and the amount disbursed directly to students as emergency financial aid grants.Criteria:The Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 18004(e), the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act Section 314(e), and the American Rescue Plan (ARP) Act Section 2003 require an institution receiving funds under HEERF I, HEERF II, and HEERF III to submit a report to the secretary, at such time in such a manner as the secretary may require. Per USDOE form instructions, BRCC must post the Quarterly Public Reporting for Institutional and MSI portions no later than 10 days after the end of each quarter on its website. Per the May 13, 2021, Federal Register, institutions must post the Quarterly Public Reporting for Student Aid portions no later than 10 days after the end of each calendar quarter.Cause:BRCC did not have adequate controls in place to ensure the accurate preparation of the reports or to ensure that the reports were publicly posted by the required deadlines. This is the second consecutive year we have reported weaknesses over HEERF reporting. Management's response to the prior-year finding indicated it would implement corrective action by June 30, 2022, and were in the process of implementing the additional controls during the fiscal year under audit.Effect:Failure to ensure the accuracy of quarterly and annual reports for the HEERF program and to ensure the reports were publicly posted by the required deadlines resulted in noncompliance with federal regulations.Recommendation:Management should strengthen its procedures over the preparation and public posting of quarterly and annual reports for the HEERF program to ensure compliance with reporting requirements.Management?s Response and Corrective Action Plan:Management concurred with the finding and outlined a plan of corrective action (B-4).

2022-014 - Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency ActAward Years: 2018 - 2021Award Numbers: S367A180017, S367A190017, S367A200017, S367A210017, S425B200042, S425D210003, S425U210003, S425W210019Compliance Requirement: ReportingRepeat Finding: Yes (Prior Year Finding No. 2021-027)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the second consecutive audit, the Department of Education (DOE) did not comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements.Our procedures disclosed the following:? For the Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) (Title II) program, no subaward information was entered into the FFATA Subaward Reporting System (FSRS) for 594 subawards of $30,000 or more totaling $167,969,408, related to four separate federal awards that were open during our audit period.See Schedule of Findings and Questioned Costs for chart/table? For the Education Stabilization Fund (ESF) program, we tested a total of 270 subawards and noted subawards that were not reported, reports not submitted timely, duplicated subawards, incorrect subaward amounts, and incorrect obligations dates.See Schedule of Findings and Questioned Costs for chart/tableCriteria:2 CFR Part 170 Appendix A(I)(a) requires the non-federal entity to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity into the FSRS no later than the end of the month following the month in which the obligation was made.Cause:DOE management indicated that this noncompliance occurred due to a weakness in internal controls over FFATA reporting, not adequately maintaining a list of federal grants for which FFATA reporting was required, and staff turnover contributing to the incomplete knowledge of FFATA reporting. Management?s response to the prior-year finding indicated it would implement corrective action by September 30, 2022, and management was in the process of implementing the additional controls during fiscal year 2022 when our audit procedures were being performed.Effect:Not reporting obligating actions to FSRS or reporting inaccurate information to FSRS prevents the public from having access to accurate information on how DOE is obligating federal funds.Recommendation:DOE should continue to strengthen internal controls to ensure accurate information is reported and ensure that appropriate personnel are aware of the federal programs that are subject to FFATA reporting. In addition, DOE should correct all amounts previously reported incorrectly.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a plan of corrective action (B-9).

2022-015 - Control Weakness over Higher Education Emergency Relief Fund ReportingAward Year: 2022Award Numbers: P425F201887, P425J200055Compliance Requirement: ReportingRepeat Finding: Yes (Prior Year Finding No. 2021-041)See Schedule of Findings and Questioned Costs for chart/tableCondition:Southern University at Baton Rouge (SUBR) did not ensure the accuracy of the quarterly and annual reports for the HEERF program.Based on our procedures, the following errors in reporting were identified:? In a non-statistical sample of two quarters from a population of four quarters, the Institutional and Historically Black Colleges and Universities (HBCU) amounts reported on the Quarterly Budget and Expenditure Reporting Form did not agree to supporting documentation. Total expenditures for quarterly reports ending September 30, 2021, and March 31, 2022, were understated by $1,089,860 and $126,584, respectively.? Annual report amounts did not agree to supporting documentation for certain items. Annual institutional expenditures for each program was understated by $2,142,639 for the Institutional program and overstated by $467,662 for the HBCU program, which resulted in a total understatement of institutional annual expenditures of $1,674,977. Also, for emergency grants, gender and age was misclassified by 145 students between categories ages 25 and older and ages 24 and younger.Criteria:The Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 18004(e), the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act Section 314(e), and the American Rescue Plan (ARP) Act Section 2003 require an institution receiving funds under HEERF I, HEERF II, and HEERF III to submit a report to the secretary, at such time in such a manner as the secretary may require.Cause:SUBR did not have an effective review process in place to ensure accurate preparation of the reports. This is the third consecutive year we have reported weaknesses over HEERF reporting.Effect:Failure to ensure the accuracy of quarterly and annual reports for the HEERF program resulted in noncompliance with federal regulations.Recommendation:Management should strengthen its procedures over the preparation and review of information reported for HEERF to ensure compliance with reporting requirements.Management?s Response and Corrective Action Plan:Management concurred in part with the finding and outlined a plan of corrective action. Management stated that it does not concur that this is the third consecutive year to have the same reported weaknesses (B-78).Auditor?s Additional Comments:While errors reported in the current-year finding may not be exactly the same as those reported in prior years, this finding is considered a repeat finding due to internal control weaknesses related to HEERF reporting requirements being reported for three consecutive audits.

2022-016 - Control Weakness over Higher Education Emergency Relief Fund RequirementsAward Year: 2022Award Number: P425F201887Compliance Requirement: Activities Allowed or UnallowedRepeat Finding: Yes (Prior Year Finding No. 2021-044)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the second consecutive year, SUBR?s calculation of lost revenue under the HEERF was not consistent with guidance provided by the USDOE. SUBR calculated lost revenue using a four-year average of fiscal years 2016 through 2019 data as the baseline revenue, instead of a five-year average of fiscal years 2015 through 2019, as was used in the corrected fiscal year 2021 lost revenue calculation. In addition, SUBR did not include the correct amount of fiscal year 2022 revenue transactions as its current-year comparison.Criteria:Per the American Rescue Plan Act, the same terms and conditions of the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act apply. Per the CRRSA Act, Section 314(c)(1), an institution of higher education may use HEERF to defray expenses associated with coronavirus (including lost revenue).On March 19, 2021, the USDOE published a HEERF I, II, and III Lost Revenue Frequently Asked Questions (FAQ) to provide further clarification regarding the calculation of lost revenue. Listed in the FAQ under Question No. 9, an institution?s calculation of lost revenue must be consistent with the cost principles of the Uniform Guidance (2 CFR Part 200 subpart E): must be accorded consistent treatment (e.g., if using the institution?s fiscal year as a baseline, the institution must estimate lost revenue over the course of a fiscal year) and be consistent with policies and procedures that apply uniformly to federally-financed and other activities of the institution.Cause:SUBR did not have an effective review process to ensure that guidance provided by the USDOE for the calculation of lost revenues was followed.Effect:Failure to adequately review and follow lost revenue guidance provided by the USDOE caused SUBR to overdraw funds in fiscal year 2022 by $1.9 million; however, SUBR had a $2.5 million under draw from fiscal year 2021 to offset this, resulting in a net under draw of approximately $600,000.Recommendation:Management should strengthen its review process and follow guidance provided by the USDOE for the calculation of lost revenues. SUBR should also revise its lost revenue calculation and return any funds overdrawn from the HEERF grant.Management?s Response and Corrective Action Plan:Management concurred in part with the finding and outlined a plan of corrective action. Management stated that it does not concur that this is the second consecutive year to have the same reported weaknesses (B-80).Auditor?s Additional Comments:Although corrections have been made for some of the issues noted in the prior-year audit finding, the results of our audit procedures indicate control weaknesses continue to exist over the related federal requirements.

2022-017 - Improper Payments to Southern University Law Center EmployeeAward Year: 2022Award Number: P031K190024Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost PrinciplesRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:Southern University (SU) Human Resources identified improper payments to a former Southern University Law Center (SULC) professor totaling $77,896. In addition, $31,898 in related benefits were paid on behalf of the professor.The SULC employee resigned from a full-time position in June 2021, while continuing to teach as an adjunct professor during the Fall 2021 semester. SU Human Resources and SULC did not terminate the full-time position in the Banner system. This allowed the employee to complete time statements and be paid for both the adjunct and the full-time position. In June 2022, SU Human Resources discovered the overpayments and requested restitution.Criteria:2 CFR 200.430(i) requires that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed, and these records must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated.The SU handbook for university personnel, federal statutes, the Louisiana Department of Civil Service, and other Louisiana laws require that the university maintain accurate accounting of hours worked on every employee. In addition, the university processes payroll electronically through Banner Web Time, which requires employees to enter time worked, leave taken, and supervisors to approve the time sheets online.Cause:This overpayment occurred due to a failure of internal controls to ensure employment status changes were updated in the Banner system and that time sheet approvals were for actual hours worked.Effect:The overpayment of $109,794 was not recouped by SULC as of June 30, 2022. Of the total overpayment, $105,567 was charged to the Higher Education Institutional Aid federal program, including $30,670 in benefits, and is considered questioned costs.Recommendation:Management should strengthen internal controls to ensure terminated employee positions are deactivated in the Banner system timely and that timesheet approvals are for hours worked.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a corrective action plan (B-81).

2022-018 - Inadequate Controls over Subrecipient AgreementsAward Years: 2019 - 2022Award Numbers: 2201LATANF, B08TI083018-01, B08TI083450-01, B09SM082603-01, B09SM083804-01, H79SM083477, H79SP081004, H79TI081691, X06SM016019-19, X06SM083694-01Compliance Requirement: Subrecipient MonitoringRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:The Acadiana Area Human Services District (AAHSD) failed to comply with all regulations set forth by 2 CFR 200.332.AAHSD is allocated federal funds from the Louisiana Department of Health (LDH), Office of Behavioral Health (OBH) as interagency transfers, and AAHSD passes these funds to other entities via contracts to perform consulting, social, and professional services. The federal programs involved had awards totaling $3,895,985 and $6,108,836 allocated to AAHSD for fiscal years 2021 and 2022, respectively.We reviewed all 28 agreements identified by AAHSD as subrecipients and determined that for 18 (64%) of the subawards, AAHSD was unable to provide documentation of whether each subrecipient was required to obtain an audit or that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Additionally, for all 28 of the subrecipients, AAHSD could not provide evidence that the required risk assessment was performed to evaluate each subrecipients? risk of noncompliance with federal regulations and the terms of the subaward.Criteria:Federal regulations require AAHSD, as the pass-through entity, to comply with 2 CFR 200.332 when subawards are made to subrecipients.Cause:AAHSD failed to develop adequate policies and procedures to ensure compliance with regulations set forth by 2 CFR 200.332 were performed timely.Effect:AAHSD or the subrecipient may not comply with the award and federal regulations.Recommendation:AAHSD management should strengthen its policies and procedures to ensure that regulations set forth by 2 CFR 200.332 are being addressed timely.Management?s Response and Corrective Action Plan:Management concurred with the finding and outlined a plan of corrective action (B-2).

2022-019 - Control Weakness Relating to Foster Care Subrecipient MonitoringAward Year: 2022Award Number: 2201LAFOSTCompliance Requirement: Subrecipient MonitoringRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:The Department of Children and Family Services (DCFS) did not adequately review subrecipient Foster Care Title IV-E (Foster Care) invoices submitted by the Department of Public Safety and Corrections ? Youth Services ? Office of Juvenile Justice (OJJ) for reimbursement of administrative expenditures to ensure billings were accurately calculated.During our procedures performed at OJJ, which was in addition to our testing conducted through sampling at DCFS, it came to our attention that on the administrative invoice for the quarter ending December 2021, there were errors due to OJJ using incorrect expenditure data, resulting in billing errors that were not detected by DCFS.Criteria:2 CFR 200.332(d) requires that pass-through entities monitor the activities of subrecipients as necessary to ensure that the subaward complies with the terms and conditions of the subaward.Per DCFS?s contract with OJJ related to the Foster Care program, DCFS agrees to receive, review, and certify expenditure reports for Foster Care expenditures.Cause:These conditions occurred because of a weakness in controls in monitoring Foster Care administrative invoices.Effect:Failure to properly review invoices resulted in an over reimbursement and could result in disallowed costs by the federal grantor. Based on the methodology used, there was $128,236 in overpayments considered questioned costs.Recommendation:DCFS should strengthen controls over review to ensure administrative invoices submitted by OJJ are calculated accurately.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a corrective action plan (B-5).

2022-020 - Noncompliance and Control Weakness Related to the Temporary Assistance for Needy Families Work Verification PlanAward Years: 2021, 2022Award Numbers: 2101LATANF, 2201LATANFCompliance Requirement: Special Tests and ProvisionsRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:DCFS did not ensure that all work activity supporting documentation for cash assistance recipients was accurate and maintained for hours worked under the Temporary Assistance for Needy Families (TANF) program.In a non-statistical sample of 60 out of 12,851 work activity records in the job-tracking system for approximately 1,000 clients per month, 13 (22%) work-eligible participant?s hours either did not agree to supporting documentation or supporting documentation of work activities was not maintained, and one of the 13 was not engaged in work activities, as required by federal regulations.Criteria:Per 45 CFR 261.61(a), a state must support each individual?s hours of participation through documentation in accordance with its Work Verification Plan.45 CFR 261.10(a)(1) states, in part, a parent or caretaker receiving assistance must engage in work activities when the state has determined that the individual is ready to engage in work.Per 45 CFR 261.65(a)(2) and 45 CFR 262.1(a)(15), if determined that the state has not maintained adequate documentation, verification, or internal control procedures to ensure the accuracy of the data used in calculating the work participation rates, the federal grantor could impose a penalty to the state of not less than one percent and not more than five percent of the adjusted state Family Assistance Grant.Cause:DCFS employees did not adhere to requirements in the state?s work verification plan pertaining to maintaining and verifying supporting documentation for the hours worked by clients and did not ensure individuals were engaged in work activities.Effect:This is the eleventh consecutive year we have reported to DCFS management exceptions with internal controls and compliance related to this TANF requirement. Noncompliance could result in penalties assessed on the state by the federal grantor.Recommendation:DCFS management should ensure DCFS employees comply with existing policies and procedures regarding the state?s work verification plan.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a corrective action plan (B-7).

2022-021 - Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency ActAward Years: 2021, 2022Award Numbers: 2101LAFOST, 2101LATANF, 2201LAFOST, 2201LATANFCompliance Requirement: ReportingRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:DCFS did not report subawards in compliance with the Federal Funding Accountability and Transparency Act (FFATA) in the FFATA Subaward Reporting System (FSRS) during fiscal year 2022 for the following federal programs:? For the Foster Care program, DCFS disbursed approximately $8.8 million in subawards to eight different subrecipients, four of which were state entities, during fiscal year 2022. These subawards account for approximately 18% of the programs? fiscal year expenditures.? For the TANF program, DCFS disbursed approximately $76.6 million in subawards to 41 different subrecipients, of which eight were state entities, during fiscal year 2022. These subawards account for approximately 48% of the programs? fiscal year expenditures.Criteria:2 CFR 170 Appendix A(I)(a) requires the non-federal entity to report to FSRS each obligating action equal to or exceeding $30,000 in federal funds for a subaward to a non-federal entity.Cause:Management represented there were no procedures in place to ensure compliance with FFATA requirements.Effect:Not reporting obligating actions to the FSRS prevents the public from having access to accurate information on how DCFS is obligating federal funds.Recommendation:DCFS should strengthen internal controls to ensure that appropriate personnel are aware of the federal programs that are subject to FFATA reporting and assign appropriate personnel to complete the FFATA reporting in accordance with federal requirements.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a corrective action plan (B-8).

2022-022 - Weaknesses in Controls over Child Care and Development Fund GrantsAward Year: 2021Award Numbers: 2101LACCC5, 2101LACSC6Compliance Requirements: Activities Allowed or Unallowed, EligibilityRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:DOE overpaid child care providers who received grants funded with child care stabilization funds from the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act and the American Rescue Plan (ARP) Act during fiscal year 2022. Our procedures disclosed the following:? DOE overpaid six child care providers who received ARP child care stabilization funds by a total of $59,063. DOE?s internal controls did not detect the overpayments.? During DOE?s review of payments to child care providers who received grant payments funded with CRRSA and ARP funds, DOE identified overpayments to 11 child care providers totaling $887,212. DOE recovered and repaid $856,139 of the overpayments to the U.S. Department of Health and Human Services, and is in the process of recovering the remaining $31,073.Criteria:DOE received CRRSA and ARP funds through the Child Care and Development Block Grant. These funds were distributed as grants to child care providers to support child care access and to provide financial support to child care providers during and/or after the COVID-19 public health emergency. The CRRSA and ARP Acts specify that payments must be made to eligible providers. In addition, good internal controls include adequate procedures to ensure payment amounts are calculated correctly and eligibility requirements are met prior to payments being made.Cause:The overpayments occurred because of a formula error in the spreadsheet DOE used to calculate the amount of funds certain providers were eligible to receive, system processing errors, incorrect eligibility determinations, and duplicate payments that were made in error.Effect:Failure to ensure the accuracy of all formulas and data in the payment calculation spreadsheet prior to payments being made increases the risk that child care providers will receive more or less funds than they are eligible to receive. Failure to ensure payment amounts are accurate and providers are eligible prior to payments being made increases the risk that funds will not be used in accordance with federal requirements.Recommendation:DOE management should strengthen internal controls to ensure that spreadsheets used to calculate payment amounts are accurate and providers meet eligibility requirements before payments are made. In addition, DOE should continue to take steps to recover the remaining overpayments.Management?s Response and Corrective Action Plan:Management concurred in part with the finding and provided a plan of corrective action (B-11).

2022-023 - Inadequate Controls and Noncompliance over ADP Risk Analysis and System Security ReviewAward Years: 2021, 2022Award Numbers: 2105LA5021, 2105LA5MAP, 2205LA5021, 2205LA5MAPCompliance Requirement: Special Tests and ProvisionsRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:The Louisiana Department of Health (LDH) did not have adequate controls in place to ensure that the Magellan Medicaid Administration (Magellan) Service Organization Control (SOC) 1 type 2 report was reviewed in accordance with the Automated Data Processing (ADP) Risk Analysis and System Security Review federal requirements for the year ending June 30, 2022. LDH contracted with Magellan in fiscal year 2022 to provide services that include maintaining system controls related to the drug rebates program.Criteria:According to 45 CFR 95.621, the state shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for on-site reviews. Good internal controls require that policies and procedures are established and followed to ensure compliance with federal requirements.Cause:LDH received the required SOC 1 type 2 report from Magellan but was unable to provide any evidence to support its review and did not have written procedures regarding the review of the SOC report.Effect:Proper review of the required SOC report is critical to ensuring the controls utilized by Magellan are adequate and operating effectively.Recommendation:LDH should design and implement procedures to document and support its review of all ADP system security reports.Management?s Response and Corrective Action Plan:Management partially concurred with the finding and provided a corrective action plan (B-19).

2022-024 - Inadequate Controls over and Noncompliance with National Correct Coding Initiative RequirementsAward Years: 2021, 2022Award Numbers: 2105LA5MAP, 2205LA5MAPCompliance Requirement: Special Tests and ProvisionsRepeat Finding: Yes (Prior Year Finding No. 2021-054)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the second consecutive year, LDH failed to properly implement and monitor National Correct Coding Initiative Requirements (NCCI) for Medically Unlikely edits (MUE) and Procedure-to-Procedure (PTP) edits for the Medical Assistance Program (Medicaid) Fee-for-Service (FFS) claims. MUE is an edit on claims in which the number of units billed on the claim are more than what is considered necessary/allowed for a particular procedure code and PTP is an edit on claims in which one specific procedure code is not allowed to be billed with a different specific procedure code on the same recipient on the same day by the same provider.Our testing of NCCI edits included all FFS claims for Durable Medical Equipment (DME), Outpatient Hospital Service (OP), and practitioner and ambulatory surgical center (PRA) paid in state fiscal year 2022. These claims were subject to two edit types: MUE and PTP.In a test of 10,115,246 paid claims to determine if the proper NCCI MUE and PTP edits had been implemented, the following was noted:? 19,683 claims for DME, OP, and PRA were paid but should have been evaluated by an NCCI MUE and denied. These NCCI MUE edit errors resulted in questioned costs of $732,101 in federal funds. LDH noted that required NCCI MUE edits have not been applied to OP and DME FFS claims due to system constraints.? 269 claims for DME, OP, and PRA were paid but should have been evaluated by an NCCI PTP edit and denied. These NCCI PTP edit errors resulted in questioned costs of $33,463 in federal funds.Criteria:Section 1903(r) of the Social Security Act requires State Medicaid agencies to incorporate NCCI methodologies into State Medicaid programs. Federal regulations and the NCCI Medicaid Technical Guidance Manual contains requirements for implementation of the NCCI methodologies.Cause:The errors noted occurred due to inadequate NCCI edit monitoring procedures by LDH and instances of noncompliance with the federal regulations and NCCI Medicaid Technical Guidance.Effect:Failure to properly implement and enforce all required NCCI edits increases the likelihood that FFS claims, which should be denied, could potentially be paid.Recommendation:Management should ensure all required NCCI edits are properly applied to FFS claims.Management?s Response and Corrective Action Plan:Management partially concurred with the finding and provided a corrective action plan (B-21).Auditor?s Additional Comments:Management?s response stated, ?The data pull does not consider the final adjudication of claims.? However, LLA data analysis included final adjudication for FFS claims paid in state fiscal year ended June 30, 2022.

2022-025 - Inadequate Controls over Billing for Behavioral Health ServicesAward Years: 2021, 2022Award Numbers: 2105LA5021, 2105LA5MAP, 2205LA5021, 2205LA5MAPCompliance Requirement: Activities Allowed or UnallowedRepeat Finding: Yes (Prior Year Finding No. 2021-055)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fourth consecutive year, LDH, the managed care organizations (MCOs), and Magellan Health Services (Magellan) did not have adequate controls in place to ensure that behavioral health services in the Medical Assistance Program (Medicaid) and Children?s Health Insurance Program (CHIP) were properly billed and that improper encounters were denied. For fiscal year 2022, we identified approximately $8.8 million in encounters for services between July 1, 2021, and June 30, 2022, that were paid by the MCOs and Magellan even though the encounters do not appear to comply with LDH?s encounter coding requirements and/or approved fee schedules.Our analysis identified the following instances of billing errors:? Providers were paid $8,329,594 for 125,734 encounters that were billed using incorrect procedure and modifier codes.? Providers were paid $489,342 more than indicated on approved fee schedules for 13,019 encounters for behavioral health services.Criteria:LDH?s fee schedule outlines procedure codes for services and the applicable billing rates. Some services require that procedure codes also contain modifier codes which indicate information such as the age of the recipient, location where the service was provided, the educational background of the person providing the service, and the license(s) they have obtained.The approved fee schedules outline different rates depending on the procedure code and modifier codes. The MCOs can optionally pay more than the minimum LDH fee schedule.Cause:The billing errors could be avoided by LDH, the MCOs, and Magellan applying system edits that would flag encounters for further review when encounter coding and/or fee schedule requirements are not followed.Effect:Without the required modifiers, the encounter does not contain enough information to determine that the billing was appropriate.Because LDH does not currently maintain a list of providers in which the MCO pays more than the minimum fee schedule, LDH cannot determine if an encounter paid at an excessive rate was improperly billed.It is important that encounter data is accurate because LDH and other stakeholders, such as the Medicaid Fraud Control Unit within the Attorney General?s Office, use this data to identify improper payments and potential fraud. LDH also uses this encounter data to establish per member per month rates for the MCOs.Recommendation:LDH should implement adequate internal controls to ensure that encounters are coded correctly, which could include edit checks to flag potential improper billings for further review.Management?s Response and Corrective Action Plan:Management concurred with the finding and outlined a plan of corrective action (B-25).

2022-026 - Inadequate Controls over Drug Rebate CollectionsAward Years: 2021, 2022Award Numbers: 2105LA5MAP, 2205LA5MAPCompliance Requirement: Allowable Costs/Cost PrinciplesRepeat Finding: Yes (Prior Year Finding No. 2021-056)See Schedule of Findings and Questioned Costs for chart/tableCondition:In a non-statistical sample of 60 drug rebate invoices from a population of 9,014, three tested (5%) revealed only a partial payment had been collected and no disputes have been made by the manufacturer. Magellan Medicaid Administration, Inc. (Magellan) personnel also confirmed that a dunning notice was not sent to these manufacturers for the unpaid balances. This is the second consecutive year LDH did not have adequate controls related to drug rebate collections.LDH contracted with Magellan for support in performing the federal and supplemental drug rebates processing for the LDH Medicaid program, including but not limited to invoicing, reconciliation, dispute resolution, and follow up on drug manufacturer (manufacturer) non-payment and aged balances for all of LDH?s Medicaid drug rebate programs. The contract sets a frequency in which a written delinquency notice (dunning notice) should be sent to manufacturers with unpaid invoices, but does not address manufacturers who make partial payments towards their quarterly invoice. Magellan personnel confirmed that for fiscal year 2022 these dunning notices are only sent to manufacturers who have not made any payments towards an invoice.Criteria:42 USC 1396r-8 requires manufacturers that wish to have their covered outpatient drugs covered by Medicaid to enter into an agreement under which the manufacturers agree to pay rebates for drugs dispensed and paid for by state Medicaid agencies under the state plan. Those rebates are shared between the state and federal government. Drug rebates are to be paid by the drug manufacturers no later than 30 days after the date of receipt of the utilization data from the state or provide notice of disputed items not paid because of discrepancies found. The state should perform follow up procedures to attempt to collect any unpaid balances in a timely manner.Cause:LDH did not have adequate controls in place to monitor its contract with Magellan and was unable to identify a control that would address the timely collection of partially-paid drug rebates invoices.In following its corrective action plan from fiscal year 2021, LDH began the process of implementing new controls to improve the outstanding balances process for all drug rebate invoices that have not been fully collected or disputed in a timely manner. Specifically, Magellan is in the process of changing its Dunning Notices process as part of the RxLink implementation to include manufacturers that only made partial payments. This process was not implemented during fiscal year 2022 though, and is expected to go live in fiscal year 2023.Effect:Without procedures to address manufacturers that do not pay the entire quarterly balance, there is a risk that appropriate rebates will not be collected.Recommendation:LDH should ensure that agency personnel are adequately monitoring contract provisions for the drug rebate program and follow up procedures are performed for all drug rebate invoices that have not been fully collected or disputed in a timely manner.Management?s Response and Corrective Action Plan:Management did not concur with the finding noting it did not have sufficient time in fiscal year 2022 for corrective action and provided its progress on addressing the finding (B-29).

2022-027 - Inadequate Controls over Monitoring of Abortion ClaimsAward Years: 2021, 2022Award Numbers: 2105LA5021, 2105LA5MAP, 2205LA5021, 2205LA5MAPCompliance Requirement: Activities Allowed or UnallowedRepeat Finding: Yes (Prior Year Finding No. 2021-057)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fourth consecutive year, LDH did not have adequate controls to ensure compliance with federal regulations prohibiting the use of federal funding for abortion claims.Criteria:42 CFR 441 Subpart E and 42 USC 1397ee(c) prohibit Medicaid and CHIP funding for abortion services except in instances where abortion is necessary to save the mother?s life or if the pregnancy is the result of an act of rape or incest.Cause:Under managed care, LDH pays the health plans monthly premiums for enrolled recipients. The health plans pay provider claims for services provided to enrolled recipients and submit the claims to LDH as encounter claims.LDH included provisions in the Healthy Louisiana managed care contracts requiring the health plans to comply with the federal regulations regarding funding of prohibited abortion services, but LDH did not have adequate procedures in place to monitor the health plans? compliance with the federal regulations. While LDH received monthly self-reported information from the health plans, LDH was not comparing or validating the self-reported information to ensure the reporting was accurate and complete for the entire year. In addition, the instructions provided to the health plans concerning how to complete the reports are not detailed and could potentially lead to all five health plans reporting different information.In fiscal year 2022, LDH began the process of implementing new controls to validate the health plans self-reported information in order to ensure compliance with federal regulations regarding the funding of prohibited abortion claims. Specifically, in July of 2022 LDH began a spot check review of the health plans self-reported encounter claims information and reviewed data retroactively for the third and fourth quarter of fiscal year 2022 (January 2022 to June 2022). However, this process was not fully implemented during fiscal year 2022, nor did it cover the first two quarters of the audit period of July 1, 2021, to December 31, 2021. It is expected this process will cover all four quarters beginning in fiscal year 2023.Effect:Claims paid by the managed care health plans for abortion services that do not meet exceptions noted in federal regulations may go undetected, and LDH may accept these improper claims as encounter claims. Encounter claims are considered in future premium rate setting and are used for reporting and monitoring of the Medicaid and CHIP programs.Recommendation:LDH should continue its process to validate self-reported information from the health plans and ensure its process is operating effectively to ensure compliance with federal regulations regarding funding of prohibited abortions claims.Management?s Response and Corrective Action Plan:Management concurred in part with the finding and provided a corrective action plan (B-32).

2022-028 - Inadequate Internal Controls over Eligibility DeterminationsAward Years: 2020 - 2022Award Numbers: 2005LA5MAP, 2105LA5021, 2105LA5MAP, 2205LA5021, 2205LA5MAPCompliance Requirement: EligibilityRepeat Finding: Yes (Prior Year Finding No. 2021-060)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the third consecutive year, LDH lacked adequate internal controls over eligibility determinations in the Medicaid and CHIP programs for the state fiscal year ending June 30, 2022.From a population of 1,919,113 Medicaid recipients, a non-statistical sample of 60 recipients was tested. Five (8.3%) out of 60 Medicaid recipients tested did not have adequate documentation to support the eligibility determination or redetermination within the recipient?s case record.The following errors were noted for Medicaid:? For one recipient, LDH personnel did not discontinue coverage on a beneficiary that was invalidly enrolled prior to the start of the public health emergency (PHE).? For one recipient, LDH personnel did not discontinue coverage on a recipient who moved out of state.? For three recipients, renewals were not performed during the state fiscal year as required by federal regulations.During our testing of Medicaid managed care premiums, we identified an additional recipient with eligibility not supported by the case record. The recipient?s case record did not reflect timely transition into an appropriate case type based on the recipient?s age.In addition, from a population of 212,933 CHIP eligibility recipients, a non-statistical sample of 60 recipients was tested. For two (3.3%) out of 60 CHIP recipients tested, LDH did not perform renewals during the state fiscal year as required by federal regulations.Criteria:42 CFR 431, 42 CFR 435, and 42 CFR 457 require that in order to be considered eligible, a recipient must meet eligibility factors and the recipient case record must include facts to support agency eligibility decision. 42 CFR 435 and 457 also require annual renewal of eligibility.42 CFR 433.400 also states in order to claim the temporary increase in the federal medical assistance percentage (FMAP), states must maintain the Medicaid enrollment of ?validly enrolled beneficiaries? in one of three tiers of coverage. States may terminate individuals not validly enrolled.LDH has outlined eligibility criteria and documentation to support determinations and renewals in its Medicaid eligibility manual.Cause:LDH did not adhere to established control procedures to ensure case records support eligibility decisions, including performance of annual renewals, per federal regulations, and the Medicaid Eligibility Manual.Effect:Proper eligibility determination and renewals are critical to ensuring appropriate service eligibility, appropriate premium payments, and appropriate federal match rate on expenditures.We noted questioned costs totaling $77,983 in federal funds in relation to the two Medicaid recipients whose coverage was not discontinued. We did not note any questioned costs related to the other errors due to certain restrictions on eligibility actions during the PHE.Recommendation:LDH should ensure its employees follow procedures relating to eligibility determinations and renewals in the Medicaid and CHIP programs to ensure the case records support the eligibility decisions.Management?s Response and Corrective Action Plan:Management did not concur with the finding and noted that the Center for Medicare and Medicaid Services (CMS) provided certain flexibilities in meeting the timeliness of renewals in accordance with 42 CFR 435.912(e)(2), and LDH used this flexibility to suspend renewals during the PHE. LDH also indicated, while there was no particular documentation in the ?case note? section of the Louisiana Medicaid Eligibility Determination System (LaMEDS), LDH provided audit staff with LaMEDS log tables which documented system jobs called ?data fixes? that were completed which set certain renewals to a future date per the approved flexibility.In addition, on the one instance of coverage that was not discontinued on a beneficiary invalidly enrolled prior to the start of the PHE, LDH noted that in November 2020 CMS issued an Interim Final Rule (CMS-9912-IFC) which provided additional information concerning the continuous enrollment period and allowable terminations and transitions during the PHE for beneficiaries invalidly enrolled. LDH?s opinion is the Interim Final Rule nor the FAQ guidance that followed provided any instruction to review or take action on cases that were prevented from termination prior to its release; therefore, LDH applied the clarification of ?validly enrolled? on decisions going forward (B-34).Auditor?s Additional Comments:The LaMEDS log tables were considered during testing by the auditor. For the exceptions related to renewals above, there was no evidence of any systems being checked with the data logs provided by LDH during state fiscal year 2022. Although CMS granted flexibilities for completing the renewals at a future date, it did not appear that CMS was granting approval for suspension of renewals. CMS also notified LDH that federal regulation requires the agency to document the reason for the delay in each case record, but there was no evidence of this in the exceptions noted above.In reference to the one beneficiary invalidly enrolled prior to the start of the PHE, LDH should have implemented the CMS Interim Final Rule (CMS-9912-IFC) to include all months during the PHE in order to discontinue coverage on a beneficiary that was invalidly enrolled prior to the start of the PHE or during the PHE.

2022-029 - Noncompliance with Managed Care Provider Enrollment and Screening RequirementAward Years: 2021, 2022Award Numbers: 2105LA5021, 2105LA5MAP, 2205LA5021, 2205LA5MAPCompliance Requirement: Special Tests and ProvisionsRepeat Finding: Yes (Prior Year Finding No. 2021-061)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fifth consecutive year, LDH did not enroll and screen Healthy Louisiana managed care providers and dental managed care providers as required by federal regulations. During fiscal year 2022, the managed care plans continued to enroll and screen some managed care providers, in violation of federal regulations.Criteria:42 CFR 438.602 (2016 Managed Care Final Rule) and Section 5005 of the 21st Century Cures Act require that the enrollment process include providing the Medicaid agency with the provider?s identifying information including the name, specialty, date of birth, Social Security number, national provider identifier, federal taxpayer identification number, and state license or certification number of the provider. Additionally, the state agency is required to screen enrolled providers, require certain disclosures, provide enhanced oversight of certain providers, and comply with reporting of adverse provider actions and provider terminations. By using the federally required process, managed care providers must participate in the same screening and enrollment process as Medicaid and CHIP fee-for-service providers.Cause:LDH noted that enrollment and screening of managed care providers was to be performed as part of a new provider management system. After cancellation of the new provider management system contract, the state?s current provider enrollment vendor, Gainwell Technologies Inc. (Gainwell), began the process of creating a web-based portal for Medicaid and its providers to complete the necessary screenings required by federal regulations.In July 2021, LDH launched the enrollment portal created by Gainwell. Although the enrollment portal was launched in fiscal year 2022, LDH gave providers until December 31, 2022, to enroll. Therefore, LDH did not enroll and screen all of the Healthy Louisiana managed care providers and dental managed care providers as required by federal regulations before the fiscal year-end.Effect:LDH cannot ensure the accuracy of provider information obtained from the Louisiana Medicaid managed care plans and cannot ensure compliance with enrollment requirements defined by law and the Medicaid and CHIP state plan. LDH accepted 96 million Healthy Louisiana encounter claims totaling $7.5 billion and 2.8 million dental encounter claims totaling $125.8 million in fiscal year 2022 from the managed care plans and paid $14.7 billion in Healthy Louisiana premiums and $375.8 million in dental premiums.Recommendation:LDH should ensure all providers are screened and enrolled as required by federal regulations.Management?s Response and Corrective Action Plan:Management concurred in part with the finding and provided a corrective action plan (B-37).

2022-030 - Noncompliance with Provider Revalidation and Screening RequirementsAward Years: 2021, 2022Award Numbers: 2105LA5021, 2105LA5MAP, 2205LA5021, 2205LA5MAPCompliance Requirement: Special Tests and ProvisionsRepeat Finding: Yes (Prior Year Finding No. 2021-063)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fifth consecutive year, LDH did not perform five-year revalidations; screenings based on categorical risk of fraud, waste, or abuse; and monthly checks of the federal excluded party database, as required by federal regulations for all Medicaid and CHIP fee-for-service providers.Based on information provided by LDH, approximately 71% of providers with claims activity in fiscal year 2022 have not had a risk-based screening with the majority of those providers enrolled more than five years ago.In addition, LDH did not routinely check required federal databases to determine if providers have been excluded from participation in federal programs. Although LDH began checking the System for Award Management (SAM) on a monthly basis beginning March of 2022, a check was not performed for all providers for all months during fiscal year 2022.Criteria:Providers are enrolled by LDH and can provide services to either Medicaid and/or CHIP recipients as applicable.42 CFR 455 Subpart E requires that LDH screen all providers according to the provider?s categorical risk level upon initial enrollment, re-enrollment, or revalidation of enrollment. LDH must complete a revalidation of enrollment for all providers, regardless of type, at least every five years. The required screening procedures for each provider varies based on the risk score ? limited, moderate, or high. For example, a high-risk score requires additional screening procedures including criminal background checks and fingerprinting.LDH submitted and received the Medicaid State Plan approval in 2012 regarding compliance with revalidation and screening requirements.42 CFR 455 Subpart E required LDH to check the List of Excluded Individuals/Entities and SAM on at least a monthly basis. The SAM database includes information on providers excluded from contracting with the federal government.Cause:LDH noted that revalidation and screening of providers was to be performed as part of a new provider management system. After cancellation of the new provider management system contract, the state?s current provider enrollment vendor, Gainwell, began the process of creating a web-based portal for Medicaid and its providers to complete the necessary screenings required by federal regulations.In July 2021, LDH launched the enrollment portal created by Gainwell. Although the enrollment portal was launched in fiscal year 2022, LDH gave providers until December 31, 2022, to enroll. Therefore, LDH did not revalidate and screen all of the providers as required by federal regulations before the fiscal year-end.Effect:Proper enrollment and revalidation, including screening based on categorical risk and monthly checks of required databases, would enable the state to identify ineligible providers that should be rejected or excluded from the program.Recommendation:LDH should ensure all providers are screened based on categorical risk level upon initial enrollment, re-enrollment, and revalidation of enrollment as required by federal regulations. Also, LDH should perform revalidation of enrollment on all providers at least every five years. In addition, LDH should ensure all required databases are checked at least on a frequency required by federal regulations.Management?s Response and Corrective Action Plan:Management partially concurred with the finding and provided a corrective action plan (B-39).

2022-031 - Weakness in Controls over and Noncompliance with Provider OverpaymentsAward Years: 2021, 2022Award Numbers: 2105LA5021, 2105LA5MAP, 2205LA5021, 2205LA5MAPCompliance Requirement: Special Tests and ProvisionsRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:During our review over the LDH?s reconciliations related to the return of the federal share of provider overpayments that have reached the one-year reporting deadline, we noted that one out of four (25%) CMS 64 quarterly reports was reconciled using incorrect data. For the quarterly report ending September 30, 2021, LDH inadvertently pulled the June 2020 report as a starting point instead of the June 2021 report when creating its one-year reconciliation. This resulted in the amount reported on the quarterly report ending September 30, 2021, to be overstated by approximately $20 million. LDH did not identify this error during its review process of the September 30, 2021 report, but did discover this error later and corrected the error on the CMS 64 quarterly report ending December 31, 2021. Therefore, we do not consider the overstatement to be questioned costs.In addition, in a non-statistical sample of 60 provider overpayments from a population of 402,032, we were unable to obtain sufficient appropriate audit evidence to determine if the federal portion of provider overpayment collections were returned to CMS in the appropriate quarter.Criteria:Pursuant to 1903(d)(2)(c) of the Act (42 USC 1396b), states have up to one year from the date of discovery of the overpayment to recover or attempt to recover the overpayment from the provider before the federal share must be refunded to CMS via the CMS 64 quarterly report, regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier.Cause:LDH?s control over compliance with federal regulations regarding the refunding of provider overpayments to CMS was not operating effectively for all quarters for the fiscal year ending June 30, 2022. In addition, LDH did not provide proper supporting documentation for the auditor to test federal regulations over provider overpayments.Effect:Provider overpayments that reached the one-year deadline in September 2021 were not accurately reported until the December 2021 CMS 64 report was completed, causing them to be late and not in compliance with federal regulations.Recommendation:LDH should strengthen its controls over the preparation of the quarterly CMS 64 reports to ensure compliance with federal regulations. In addition, LDH should ensure it is able to provide supporting documentation timely for amounts reported in the CMS 64 reports for overpayments.Management?s Response and Corrective Action Plan:Management did not concur with the finding noting LDH Fiscal is currently in the process of revising procedures to ensure provisions of the 365-Day Receivable report as supporting documentation for provider overpayments (B-41).

2022-032 - Control Weakness Related to Foster Care BillingsAward Year: 2022Award Number: 2201LAFOSTCompliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost PrinciplesRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:OJJ did not adequately review Foster Care invoices submitted to DCFS for reimbursement to ensure billings were accurately calculated.In a non-statistical sample of two quarterly administrative invoices billed to DCFS totaling $831,311 from a population of four quarterly administrative invoices totaling $1,708,503, one (50%) invoice for the quarter ending December 2021 was calculated using incorrect expenditure data, resulting in billing errors.Criteria:2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award.Per OJJ?s contract with DCFS for reimbursement of Foster Care expenditures, OJJ must submit quarterly administrative billing reports to DCFS and monitor and track allowable administrative claim information.Cause:These conditions occurred because of a weakness in controls in the review of Foster Care administrative invoices.Effect:Failure to properly review invoices resulted in over billings and could result in disallowed costs by the federal grantor. Based on the methodology used, there was $128,236 in overpayments considered questioned costs.Recommendation:OJJ should strengthen controls to ensure administrative invoices submitted to DCFS are calculated accurately.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a corrective action plan (B-45).

2022-033 - Weakness in Controls over Research and Development ProjectCloseouts and Accounting RecordsAward Years: 2021, 2022Award Numbers: 1K01AA024494-01A1, 1R21AA026022-01A1, 1R44DA046300-01, 2R01DK087800-06A1, 2R37AA018282-06, GM104940-17025-HSCNO01, INS151591-2, PO-0000180812, WFUHS 35-101730-117901Compliance Requirement: Period of PerformancePass-Through Entities: Eastern Virginia Medical School, La Jolla Alcohol Research, Inc., Wake Forest University HSCRepeat Finding: Yes (Prior Year Finding No. 2021-006)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the third consecutive year, the Louisiana State University Health Sciences Center in New Orleans (LSUHSC-NO) did not have adequate controls over project closeouts or accounting records for the R&D cluster federal program. We tested a non-statistical sample of 18 R&D projects, plus an additional five projects based on the total transaction amount recorded more than 90 days after the project end date, from a population of 139 projects with end dates between April 1, 2021, and June 30, 2022. Five (27.8%) of the sampled projects and all five of the additional projects included transactions for expenses or correcting entries posted to the project between 120 and 402 days after the project?s period of performance ended. On three of the additional projects, management submitted revised final reports to the grantor, or revised final invoices to the pass-through entity, more than 120 days after the period of performance ended resulting in noncompliance with federal program close-out requirements.Criteria:2 CFR 200.344 requires (a) that the recipient must submit, no later than 120 calendar days (or 90 days for a subrecipient) after the end of the period of performance, all reports required by the terms and conditions of the award, and (b) unless the federal awarding agency or pass-through entity authorizes an extension, a non-federal entity must liquidate all financial obligations incurred under the federal award no later than 120 calendar days after the end date of the period of performance.Additionally, LSUHSC-NO?s Sponsored Agreement Closeout Policy requires that completed sponsored agreements with surplus and/or deficit residual balances remaining in the project be certified and transferred to an appropriate, non-sponsored, departmentally-funded account or another sponsored project within 90 days of the project end date. LSUHSC-NO?s Sponsored Projects Accounting Cost Transfer Policy 011019 cautions that cost transfers will not be processed to cover cost overruns, to avoid restrictions by the Sponsor, to use up unspent funds, or for reasons of convenience or broadly-defined ?errors.?Cause:These exceptions occurred because (1) expenses are charged to projects after their closeout period in anticipation of a forthcoming project renewal, extension, or funding increase that may or may not be received; (2) the accounting system, PeopleSoft Commitment Control, allows certain personnel and other expenses to continue to post to projects after the project has ended unless a form, such as a change in source of funds form, is processed to update account coding in the system; (3) projects are not being closed out properly as they end, which includes submitting all required forms for updating accounting records; and (4) project budgets were not adequately monitored to ensure that expenses in the accounting system were charged to the correct project and any errors or budget overruns were identified and addressed in a timely manner.Effect:Untimely project updates in the accounting system increase the risk that expenses will be charged to the wrong project which hinders management?s ability to effectively monitor the budget and may result in budget overruns that would need to be covered with other funding sources, increase the number of corrections required at year end to ensure accurate financial reporting, and may result in noncompliance with federal program requirements.Recommendation:Management should continue to monitor budgets and ensure that budget overruns and errors are identified and corrected in a timely manner. Management should ensure that projects are effectively closed out including processing all required forms and updating the accounting system in a timely manner. Management should consider implementing a system control to prevent costs from being charged to projects in the accounting system beyond the project close out period. Management should also implement controls to exclude costs from its Schedule of Expenditures of Federal Awards until the awards or extensions are approved.Management?s Response and Corrective Action Plan:Management concurred with the finding and provided a corrective action plan (B-46).

2022-034 - Noncompliance and Weakness in Controls with Special Tests and Provisions RequirementsAward Years: 2018, 2022Award Numbers: P20GM121307, R56NS114272Compliance Requirement: Special Tests and ProvisionsRepeat Finding: Yes (Prior Year Finding No. 2021-069)See Schedule of Findings and Questioned Costs for chart/tableCondition:For the fourth consecutive year, LSUHSC-S did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. We reviewed a non-statistical sample of 14 federal R&D Cluster awards, plus two additional awards based on materiality, for the fiscal year ending June 30, 2022, from a population of 54 awards with a total of 28 key personnel. We reviewed the quarterly Time and Effort Certification forms, as applicable, for each key personnel for each award selected.We noted two of 28 (7%) key personnel had documentation of actual effort on the Time and Effort Certification forms that did not agree to the effort reported to the federal grantor, and there was no evidence of prior approval from the federal grantor for a change in key personnel.Criteria:2 CFR 200.308(c) states that for non-construction federal awards, recipients must request prior approvals from federal awarding agencies for one or more of the following program or budget-related reasons: (i) change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval); (ii) change in a key person specified in the application or the federal award; (iii) the disengagement from the project for more than three months, or a 25% reduction in time devoted to the project, by the approved project director or principal investigator.Cause:During fiscal year 2022, LSUHSC-S was in the process of implementing its corrective action plan. This included review of some time and effort certifications as training was performed, development of an updated Personnel Change (PER-3) form that now includes percentage effort documentation, and defined responsibilities for reporting changes in level of effort and requesting grantor approval as needed.Effect:Failure to implement controls over key personnel requirements could result in noncompliance with Special Tests and Provisions requirements.Recommendation:Management should continue to provide training for time and effort certifications. Management should also utilize the time and effort certifications and updated PER-3 forms to monitor changes in effort for key personnel and verify that prior written approval is obtained from the federal grantor for changes that exceed the thresholds set in federal regulations.Management?s Response and Corrective Action Plan:Management concurred with the finding and outlined a plan of corrective action (B-49).

2022-035 - Weakness in Controls over Cash Management RequirementsAward Years: VariousAward Numbers: VariousCompliance Requirement: Cash ManagementRepeat Finding: NoSee Schedule of Findings and Questioned Costs for chart/tableCondition:LSUHSC-S did not follow its prescribed controls over compliance with the cash management requirements of R&D programs. We reviewed a non-statistical sample of 25 federal R&D expense transactions resulting in reimbursement request support for two subaward invoice reconciliations and ten monthly direct award reconciliations, for the fiscal year ending June 30, 2022, from a population of 11,969 expense transactions. We also reviewed the two monthly reconciliations for July and November 2021 that were not selected from the expense transactions. We noted the following:? Four (29%) of 14 reconciliations had no evidence of review or approval by someone other than the preparer.? Ten (71%) of 14 approved reconciliations did not agree to the reimbursement request submitted to the grantor.Criteria:2 CFR 200.303 requires that non-federal entities establish and maintain internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.LSUHSC-S has established controls over cash management requirements, which consist of a monthly reconciliation of reimbursement requests for R&D expenses and includes the review and approval by someone other than the preparer.Cause:LSUHSC-S did not follow its established controls over monthly reconciliations.LSUHSC-S represented that the monthly reconciliations are the starting point in the process and additional determinations of which amounts should be drawn down are made after the reconciliation has been completed. LSUHSC-S did not provide any evidence that additional review and approval was performed prior to the reimbursement request.LSUHSC-S did not perform the drawdowns on a monthly basis when the reconciliations were performed. Drawdowns were performed in March and June 2022, and after fiscal year end in July, August, and October 2022 for expenses incurred during the fiscal year ending June 30, 2022. Management provided additional reconciliations for the draw down amounts, but there was no evidence of review and approval by someone other than the preparer.Effect:Failure to implement sufficient controls over cash management could result in LSUHSC-S requesting reimbursement for expenses not incurred prior to the request and place LSUHSC-S in noncompliance with federal regulations.Recommendation:LSUHSC-S should ensure that a review and approval is performed on the final amounts requested for reimbursement and evidence is maintained. LSUSHC-S should also ensure that established controls are followed to ensure the review and approval is performed by someone other than the preparer.Management?s Response and Corrective Action Plan:Management concurred with the finding and outlined a plan of corrective action (B-55).

2021-005 - Inadequate Controls over Payroll Award Year: 2021 Award Numbers: NU50CK000532, NU62PS005012, NU62PS924522, NU62PS924620, NU90TP922016, SLT0084 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: Yes (Prior Year Finding No. 2020-006) See Schedule of Findings and Questioned Costs for chart/table Condition: The Louisiana Department of Health, Office of Public Health (OPH) did not ensure payroll expenditures were timely certified and approved for the Public Health Emergency Preparedness program, the HIV Prevention Activities Health Department Based program, the Epidemiology and Laboratory Capacity for Infectious Diseases program, the WIC Special Supplemental Nutrition Program for Women, Infants, and Children, and the Coronavirus Relief Fund. This is the second consecutive year payroll internal control deficiencies have been reported for Public Health Emergency Preparedness, HIV Prevention Activities Health Department Based, and Coronavirus Relief Fund. Exceptions for each federal program are as follows: ? For the Public Health Emergency Preparedness program, we selected a non-statistical sample of 60 payroll transactions tested from a population of 1,444 transactions totaling $3,717,081. Twenty-seven (45%) time statements were not timely approved by the employees? supervisors, of which ten (17%) were not approved at all, and two (3%) were not certified by the employees. ? For the HIV Prevention Activities Health Department Based program, we selected a non-statistical sample of 60 payroll transactions tested from a population of 1,039 transactions totaling $434,959. Twenty-two (37%) time statements were not timely approved by the employees? supervisors, of which five (8%) were not approved at all, and two (3%) were not certified by the employees. ? For the Epidemiology and Laboratory Capacity for Infectious Diseases program we selected a non-statistical sample of 40 payroll transactions tested from a population of 1,509 transactions totaling $2,280,115. Seventeen (43%) time statements were not timely approved by the employees? supervisors, of which ten (25%) were not approved at all, and three (8%) were not certified by the employees. ? For the WIC Special Supplemental Nutrition Program for Women, Infants, and Children, we selected a non-statistical sample of 25 payroll transactions tested from a population of 6,535 transactions totaling $9,592,395. One (4%) of 25 time statements was not timely approved by the employee?s supervisor and was approved 143 days after the posting date. ? For the Coronavirus Relief Fund program, we reviewed 100% of the time statements from April 5, 2021, through June 27, 2021, in which we identified 802 (10%) of 7,884 time statements that were not approved by the employees? supervisors. As a result of the high exception rates noted above, additional procedures were performed to determine the exception rate of time statements that were not certified or approved for all OPH employees during the entire fiscal year. OPH uses electronic time statements, which allows for an electronic determination of employee certification and supervisor approval. Based on audit procedures conducted on all payroll transactions in fiscal year 2021, we identified 2,050 (6%) of 36,374 time statements that were not certified by employees and 5,049 (14%) of 36,374 time statements that were not approved by the employees? supervisors, which includes the exceptions noted above for each program. Criteria: 2 CFR 200.430(i) states that records must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Furthermore, the records must comply with the established accounting policies and practices of the non-federal entity. The Division of Administration Personnel Policy No. 99 requires employees and supervisors to certify and/or approve time statements for accuracy by 10:00 p.m. on the Wednesday following the close of the pay period. Time administrators are responsible for reviewing the LaGov ZP241 eCertification Report prior to processing to identify any employees who have not certified their time statements and any supervisors who have not approved their staff?s time statements. Cause: OPH lacked sufficient controls to ensure electronic time statements were properly certified and approved prior to the posting date in accordance with federal and state regulations. Effect: Failure to adequately approve program expenditures increases the risk that unallowable costs could be reimbursed by the federal grantor. Recommendation: OPH should ensure employees comply with existing policies and procedures, including properly certifying and approving electronic time statements in a timely manner. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-59).

2021-006 - Weakness in Controls over Research and Development Project Closeouts and Accounting Records Award Years: 2020, 2021 Award Numbers: 1R01AA023305, 1R21AA025736, 1R41AI138722A1, 5K010D023039-02, 5P30AI064518, 5UMICA121947-1, W81XWH-18-1-0 Compliance Requirement: Period of Performance Pass-Through Entities: Autoimmune Technologies, LLC, Duke University, Emory University, University of California, Los Angeles Repeat Finding: Yes (Prior Year Finding No. 2020-059) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, the Louisiana State University Health Sciences Center ? New Orleans (LSUHSC-NO) did not have adequate controls over project closeouts or accounting records for the Research and Development (R&D) cluster federal program. In a test of all 26 R&D projects with end dates between July 1, 2020, and March 31, 2021, eight projects (31%) were identified with transactions for expenses or correcting entries posted to the project between 92 and 524 days after the project?s period of performance ended. Criteria: 2 CFR 200.344 requires (a) that the recipient must submit, no later than 120 calendar days (or 90 days for a subrecipient) after the end of the period of performance, all reports required by the terms and conditions of the award, and (b) unless the federal awarding agency or pass-through entity authorizes an extension, a non-federal entity must liquidate all financial obligations incurred under the federal award no later than 120 calendar days after the end date of the period of performance. Additionally, LSUHSC-NO?s Sponsored Agreement Closeout Policy requires that completed sponsored agreements with surplus and/or deficit residual balances remaining in the project be certified and transferred to an appropriate, non-sponsored, departmentally-funded account or another sponsored project within 90 days of the project end date. LSUHSC-NO?s Sponsored Projects Cost Transfer Policy dated 1/11/2019 cautions that cost transfers will not be processed to cover cost overruns, to avoid restrictions by the sponsor, to use up unspent funds, or for reasons of convenience or broadly-defined ?errors?. Cause: These exceptions occurred because (1) expenses are charged to projects after their closeout period in anticipation of a forthcoming project renewal, extension, or funding increase that may or may not be received; (2) the accounting system, PeopleSoft Commitment Control, allows certain personnel and other expenses to continue to post to projects after the project has ended unless a form, such as a personnel status change form, is processed to update account coding in the system; (3) projects are not being closed out properly as they end which includes submitting all required forms for updating accounting records; and (4) project budgets were not adequately monitored to ensure that expenses in the accounting system were charged to the correct project and any errors or budget overruns were identified and addressed in a timely manner. Effect: Untimely project updates in the accounting system increase the risk that expenses will be charged to the wrong project which hinders management?s ability to effectively monitor the budget and may result in budget overruns that would need to be covered with other funding sources, increase the number of corrections required at year end to ensure accurate financial reporting, and may result in noncompliance with federal program requirements. None of these costs were requested for federal reimbursement on the closed project. Recommendation: Management should continue to monitor budgets and ensure that budget overruns and errors are identified and corrected in a timely manner. Management should ensure that projects are effectively closed out including processing all required forms and updating the accounting system in a timely manner. Management should consider implementing a system control to prevent costs from being charged to projects in the accounting system beyond the project close out period. Management should also consider using temporary non-federal account coding to record costs for new awards or extensions that are not yet finalized and exclude these costs from its SEFA until the award or extension is final. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-75).

2021-007 - Noncompliance with and Weakness in Controls over Federal Research and Development Expenses Award Years: Various Award Numbers: Various Compliance Requirements: Allowable Costs/Cost Principles, Period of Performance Pass-Through Entities: Various Repeat Finding: Yes (Prior Year Finding No. 2020-008) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, the Louisiana State University Health Sciences Center - Shreveport (LSUHSC-S) did not ensure internal control over documentation of personnel services were operating effectively, and in addition, did not ensure compliance with federal guidance regarding cost transfers applicable to the R&D Cluster. In a non-statistical random sample of 10 out of 4,392 payroll expense transactions charged to R&D, four (40%) Time and Effort Certifications were completed eight to 22 days after the date required by policy. We performed an analysis of payroll adjusting journal entries to record cost transfers to and/or from R&D awards. We noted that 2,346 out of 4,338 adjusting journal entries were made more than 60 days after the end of the quarter from the original transactions. The adjustments were made 129 to 990 days after the original transactions were recorded and 68 to 904 days after the quarter ended. We selected a non-statistical random sample of 17 R&D projects and tested the first 19 payroll adjusting journal entries, by employee and journal id. The sample was selected from a total population of 86 projects with 355 payroll adjusting journal entries by employee and journal id. For 12 of the 19 (63%) adjusting entries tested, LSUHSC-S did not maintain adequate documentation for cost transfers to fully explain how the error occurred and a sufficient explanation to support the correctness of the new charge. Criteria: 2 CFR 200.430(i)(1)(i) requires that charges to federal awards for salaries and wages must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Per 2 CFR 200.430(i)(1)(viii), budget estimates alone do not qualify as support for charges to federal awards, but may be used for interim accounting purposes, provided that significant changes in work activity are identified and entered into the records in a timely manner and the non-federal entity?s system of internal controls includes processes to review after-the-fact charges and make necessary adjustments. Per LSUHSC-S?s Time and Effort Certification Policy and Procedures, LSUHSC-S utilizes Time and Effort Certifications to support salary charges to sponsored projects as an after-the-fact certification of effort of all individuals when all or a portion of their salaries are charged to a sponsored project. Projects are established by LSUHSC-S to track federal awards. Based on LSUHSC-S?s policy, the Time and Effort Certifications should be completed within approximately 30 days of the end of the quarter. Management interprets the end of the quarter to be when the time and effort reports are sent to the departments once the last month of the quarter is closed in the accounting system. If there is a substantial (5% or more) difference between the salary charges and the effort actually expended by the individual on projects during the quarterly reporting period, a payroll reallocation must be created within 30 days. Per 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award. These internal controls should be in compliance with guidance in the ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Standards for Internal Control in the Federal Government, examples of common categories of control activities include accurate and timely recording of transactions. In addition, the National Institute of Health (NIH) is the grantor for the majority of LSUHSC-S?s R&D grant awards. Per the NIH Grants Policy Statement, cost transfers that represent corrections of clerical or bookkeeping errors should be accomplished within 90 days of when the error was discovered. The transfers must be supported by documentation that fully explains how the error occurred and a certification of the correctness of the new charge by a responsible organizational official. An explanation merely stating that the transfer was made to "correct error" or "to transfer to correct project" is not sufficient. Transfers of costs from one project to another or from one competitive segment to the next solely to cover cost over-runs are not allowable. Cause: Although LSUHSC-S has procedures in place for personnel to certify actual time and effort expended on federal awards, management represented that additional training of department personnel was needed on how to appropriately complete the time and effort certification reports. LSUHSC-S held trainings in fiscal year 2021; however, the training and compliance review did not continue as originally planned due to staffing issues. LSUHSC-S currently has a Cost Transfer Form that, if properly completed, would satisfy the documentation requirements for cost transfers. LSUHSC-S is not currently using this form to document cost transfers. Instead, LSUHSC-S is using a payroll form to document cost transfers that is not designed to adequately document justification for cost transfers in accordance with federal guidance. Effect: Untimely certifications and the untimely discovery and correction of errors increases the risk of inaccurate reporting and may result in an inability to complete approved projects within the approved budget and/or period of performance. As a result, LSUHSC-S may have to utilize university funds to complete the approved project. Recommendation: Management should monitor Time and Effort Certifications completed by the departments and investigate and obtain justification from department personnel for untimely certifications as well as untimely adjustments and lack of supporting documentation for the adjustments to enforce policies established. Management should also consider implementing other complementary controls such as preventing costs from being charged to projects in the accounting system beyond the approved budget or period of performance. Furthermore, management should consider using the Cost Transfer Form, or revise the payroll form currently being used, to adequately document cost transfers. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-80).

2021-008 ? Inadequate Controls over and Noncompliance with Unemployment Insurance Benefits Requirements Award Year: AL 17.225 - Not Applicable; AL 97.050 - 2020 Award Number: AL 17.225 - Not Applicable; AL 97.050 - FEMA 4484DRLASPLW Compliance Requirements: Activities Allowed or Unallowed, Eligibility Repeat Finding: Yes (Prior Year Finding No. 2020-012) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, the Louisiana Workforce Commission (LWC) did not have adequate internal controls and did not comply with requirements of the Unemployment Insurance (UI) federal program. LWC issued more than $5.6 billion in benefit payments to more than 619,000 claimants during fiscal year 2021. Because of the large amount of funding provided during the COVID-19 pandemic and the lack of identity or wage requirements at the beginning of the year, these programs have been exposed to identity theft and fraud schemes. In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which included funding for new UI programs. These new programs are funded entirely with federal funds and include the Pandemic Unemployment Assistance (PUA) program and the Federal Pandemic Unemployment Compensation (FPUC) program. The PUA extended unemployment benefits to claimants that did not qualify for UI, but had lost their job due to the COVID-19 pandemic, including those that were self-employed and gig workers. FPUC provided claimants receiving UI or PUA benefits an extra $600 per week through July 2020. In August 2020, the Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs [Lost Wages Assistance (LWA)] program provided an extra $300 per week for six weeks if a claimant earned at least $100 per week in UI or PUA benefits. In December 2020, Congress passed the Continued Assistance for Unemployed Workers Act of 2020 (CAA), which extended many of the UI-related provisions in the CARES Act and also required claimants to provide supporting documents to verify income and identity. We tested a non-statistical random sample of 138 claimants who were paid $1,304,848 in unemployment benefits in fiscal year 2021. Ninety-three of the claimants received UI/FPUC/LWA benefits, and 45 received PUA/FPUC/LWA. Because some claimants had multiple errors, the known questioned costs were evaluated by claimant. Our audit procedures identified the following, which resulted in questioned costs totaling $257,728. ? 14 (10%) out of 138 claimants reviewed had inconsistent or missing information on the UI application which may indicate the claimant is intentionally filing to receive benefits that they are not entitled, or that may indicate possible identify theft. These inconsistencies included job history information on the application that did not agree with the UI database; incomplete job information on the application; questionable and contradictory personal contact information including email, telephone number, and address when compared with work location; and contradictory information about the last day of work. ? 15 (33%) out of 45 PUA claimants were required to provide proof of wages after the requirement was instated, but never provided any wage documentation. CAA required all claimants receiving federal assistance payments after December 27, 2020, to provide evidence of self-employment earnings in order to remain eligible for PUA. ? 9 (20%) out of 45 PUA claimants did not have identification on file after the requirement was instated per CAA. The U.S. Department of Labor issued guidance on January 8, 2021, to require identity verification of applicants by January 20, 2021. Of the claimants, five identifications were requested and not received, and four identifications were not requested. ? Deductions were not properly withheld for six (4%) of the 138 claimants reviewed. All six of these exceptions related to child support deductions. Five of the cases were never set up after LWC received the child support enforcement notice from the Department of Children and Family services (DCFS). One case was set up by LWC, but subsequently removed without notice from DCFS. Criteria: 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. 2 CFR 200.302(b)(4) states the financial management system of each non-federal entity must provide effective control over, and accountability for, all funds, property, and other assets. The non-federal entity must adequately safeguard all assets and assure that they are used solely for authorized purposes. 20 CFR 625 (Appendix C, Section 7511) states the Secretary of Labor interprets the Social Security Act [Section 303(a)(1)] to require that a state law include provision for such methods of administration as are, within reason, calculated (1) to detect benefits paid through error by the agency or through willful misrepresentation or error by the claimant or others, and (2) to deter claimants from obtaining benefits through willful misrepresentation. The CAA which extended many of the UI-related provisions in the CARES Act also required claimants to provide supporting documents to verify income and identity. Per Louisiana Revised Statute (R.S.) 23:1601(8)(a), individuals are disqualified for benefits for the week, or fraction thereof, with respect to which he makes a false statement or representation knowing it to be false, or knowingly fails to disclose a material fact in obtaining or increasing benefits, whether or not he is successful in obtaining or increasing benefits, or otherwise due to his fraud receives any amount as benefits under to which they are not entitled. R.S. 23:1693 requires child support to be deducted from unemployment compensation when notified by DCFS. Cause: LWC implemented internal controls throughout the year to identify possible fraud or disqualification from the programs that could lead to overpayments. However, personal identifying information and wage documents only began to be collected at mid-year, as the requirements of CAA went into effect. LWC was not able to obtain all of the required information after the claims were already established and, therefore, benefits continued to paid on some claimants without the proper documentation. LWC?s procedures for the establishment of child support deductions are manual and became ineffective due to the volume of claims processed during the pandemic. Effect: Failure to obtain personal identifying information and wage documents results in noncompliance with federal program requirements and increases the risk of overpayments resulting from fraudulent claims. Failure to properly withhold child support payments results in noncompliance with state laws. Recommendation: LWC should strengthen controls to ensure all required wage and identification documents are obtained. In addition, LWC should take the necessary actions to ensure child support deductions are setup timely and to ensure LWC is compliant with applicable laws. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and outlined a plan of corrective action. Management provides that it is not practical to review each claim for inconsistent information due to the sheer volume of claims filed. Management notes that proof of wages was not initially required for the PUA program, and claimants did not have to provide until the information was requested by LWC. Per management, although not all claimants were required to provide proof of identity, LWC implemented identity verification requirements, but the workload required to verify the documents provided was substantial. Finally, management indicates issues with child support deductions not properly withheld occurred due to the fact that the child support deductions are processed manually, due to the onslaught of claims volume during the past year, and due to the increase in child support orders (B-90). Auditor?s Additional Comments: While the inconsistent and missing information, including the child support orders that were not processed, was mainly caused by the volume of claims processed during the fiscal year, LWC remains responsible for administering the UI program with adequate internal controls to remain in compliance with federal requirements, as well as to prevent and detect fraud.

2021-009 - Control Weakness and Noncompliance with Personnel Expenses Charged to Federal Awards Award Years: 2015, 2018, 2020, 2021 Award Numbers: Various Compliance Requirements: Allowable Costs/Cost Principles, Special Tests and Provisions Repeat Finding: No Pass-Through Entities: Beth Israel Deaconess Medical Center, Coushatta Tribe of Louisiana, University of Washington See Schedule of Findings and Questioned Costs for chart/table Condition: The University of Louisiana at Lafayette (UL Lafayette) did not have adequate controls in place to ensure personnel expenses and effort charged to federal R&D awards accurately reflected work performed. From a population of 22,636 payroll and non-payroll expenses charged to R&D grants, a non-statistical sample of 25 transactions were tested. For all 11 (44%) of the payroll transactions, UL Lafayette was unable to provide documentation to show that personnel related expenses, totaling $11,482, were supported by time and effort certifications to ensure the accuracy of budget estimates charged to federal awards as required by federal regulations. Additionally, because there is no after-the-fact review to ensure the accuracy of personnel costs and effort charged to the awards, UL Lafayette could not ensure compliance with the requirements of special tests and provisions related to key personnel effort. Criteria: 2 CFR 200.430(i) specifies the documentation standards for personnel expenses. In order to be allowable, charges to federal awards for personnel expenses must be based on records that accurately reflect the work performed and must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Budget estimates alone do not qualify as support for charges to federal awards, but can be used for interim accounting purposes provided that internal controls include an after-the-fact review to confirm the accuracy of final amounts charged to federal awards. Prior approval requirements related to key personnel effort are contained in 2 CFR 200.308(c) and within grant terms and conditions. A reduction of 25% or greater in time devoted to the project from key personnel requires prior approval. Cause: Management represented, that due to a high rate of turnover in the Office of Sponsored Programs Administration and Compliance from February through October 2021, time and effort certifications were not completed by employees to support the accuracy of budget estimates charged to federal awards as required by 2 CFR 200.430(i). Effect: Inadequate controls related to federal documentation standards for personnel expenses could result in noncompliance with federal allowable costs and cost principles, as well as noncompliance with special tests and provisions related to key personnel effort. Recommendation: Management should strengthen internal controls to ensure that personnel expenses charged to the federal awards are supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-121).

2021-010 - Noncompliance with Subrecipient Monitoring Requirements Award Years: 2017 - 2020 Award Numbers: 1726965, P01AI048240, U19AI142636 Compliance Requirement: Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: UL Lafayette did not adequately monitor subrecipients of the R&D Cluster programs. In a non-statistical sample of four grants out of a population of 20 grants, which included five subawards to four different subrecipients requiring monitoring, it was noted that for three (75%) of the subrecipients evaluated, UL Lafayette was unable to provide documentation that ensured each subrecipient obtained the required audit and that the audit was reviewed so that timely and appropriate action could be taken for any findings pertaining to the federal awards, as required by federal regulations. Additionally, for all four (100%) of the subrecipients evaluated, UL Lafayette could not provide evidence that the required risk analyses were performed to evaluate each subrecipients? risk of noncompliance with federal regulations and the terms of the subaward. Criteria: 2 CFR 200.332(b) requires pass through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Per 2 CFR 200.332(f), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR Part 200, Subpart F when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in CFR 200.501 of $750,000 or more in federal awards during the subrecipient?s fiscal year. 2 CFR 200.332(d)(2) requires that pass-through entities follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies provided to the subrecipient from the pass-through entities detected through audits, on-site reviews, and written confirmation from the subrecipient. 2 CFR 200.332(d)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient?s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Cause: UL Lafayette management indicated that being understaffed has impacted the ability to perform adequate subrecipient monitoring. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal awarding agency. Recommendation: UL Lafayette should strengthen controls to ensure the timely review of all required subrecipient audit reports in order to evaluate the impact of any findings noted by the audit and issue management decision letters, if applicable. In addition, UL Lafayette should strengthen controls to ensure risk assessments are performed and documented on all subrecipients in accordance with federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-124).

2021-011 ? Failure to Provide a Listing of Food Benefits Paid for the WIC Program Award Year: 2021 Award Number: 6LA700503 Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: OPH could not provide a detailed listing of food benefits paid, including dollar value, to eligible participants during fiscal year 2021 for the WIC Special Supplemental Nutrition Program for Women, Infants, and Children (WIC). In fiscal year 2021, OPH reported $75.3 million in WIC program expenditures in its SEFA. OPH should have a mechanism to account for all program funds received and expended, including food benefits paid to participants. Criteria: Per 2 CFR 200.302(a), each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-federal entity's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Per 2 CFR 200.430(i), records must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Furthermore, the records must comply with the established accounting policies and practices of the non-federal entity. Per 7 CFR 246.13(a), the state agency shall maintain a financial management system which provides accurate, current and complete disclosure of the financial status of the program. This shall include an accounting for all property and other assets and all program funds received and expended each fiscal year. Per 7 CFR 246.13(c), the state agency shall maintain records which adequately identify the source and use of funds expended for program activities. These records shall contain, but are not limited to, information pertaining to authorization, receipt of funds, obligations, unobligated balances, assets, liabilities, outlays, and income. Cause: After numerous requests, conference calls, and conversations with OPH personnel, OPH could not provide a detailed listing of food benefits paid to participants in fiscal year 2021. Reports provided to us by OPH included quantities of items purchased without detail of dollar amounts paid to participants by the program. Since OPH began using electronic benefits transfer (EBT) cards instead of paper checks/vouchers in fiscal year 2019, OPH management stated that the federal grantor does not require state agencies to review benefits paid to participants. Effect: Since OPH was unable to provide a detailed listing of food benefits paid, including dollar value, in fiscal year 2021, we were unable to obtain sufficient appropriate audit evidence to adequately test the activities allowed or unallowed compliance requirement for this program. We consider this a scope limitation for our audit. Recommendation: OPH should continue to work with its contractor to develop a reporting mechanism to account for and track the costs of WIC food benefits paid by participants. Management?s Response and Corrective Action Plan: Management did not concur with the finding (B-55). Auditor?s Additional Comments: Management noted that a summary report detailing every transaction for every WIC participant in fiscal year 2021 does not exist and would take tremendous time and effort to develop; however, this information was produced by OPH in previous audits of the WIC program. To test the purchase of supplemental foods for participants, we requested a report detailing food packages (benefits) paid or a report detailing specific payments made to vendors. OPH provided a listing of transactions paid to WIC authorized vendors and a listing of EBT redemption amounts by clinic site; however, these reports only included summary totals of payments without detailed purchases of supplemental foods. In addition, OPH provided a listing of EBT card transactions with redeemed food quantities; however, since the listing did not contain dollar amounts, we were unable to determine the accuracy and completeness of the data. Management stated on May 6 2022, that the actual claim amounts for vendor transactions specific to EBT redemptions with transaction level data would be provided by May 13, 2022. OPH provided a listing of EBT card transactions with redeemed food quantities; however, once again the listing did not contain dollar amounts. OPH further notes that it has controls in place to adequately track and account for its federal program expenditures to demonstrate compliance; however, the Office of Management and Budget (OMB) Compliance Supplement requires the auditor to identify the types of activities which are either specifically allowed or prohibited by federal statutes, select a sample of transactions, and perform procedures to verify that the transaction was for an allowable activity. We were unable to obtain necessary information to conduct procedures for testing to determine compliance with the activities allowed or unallowed requirement or if controls over compliance with the activities allowed or unallowed requirement for the WIC program were adequate.

2021-012 ? Inadequate Recovery of Small Rental Property Program Loans Award Years: 2006, 2007 Award Numbers: B-06-DG-22-0001, B-06-DG-22-0002 Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2020-011) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2021, the Division of Administration, Louisiana Office of Community Development (LOCD) identified $4,335,784 in Small Rental Property Program (SRPP) loans for 42 property owners under the Community Development Block Grants/State?s Program (CDBG) who failed to comply with one or more of their loan agreement requirements and were assigned to loan recovery status. Since LOCD has not recovered these loans, we consider these amounts totaling $4,335,784 to be questioned costs. In addition, 1,194 noncompliant loans identified in previous years totaling $110.4 million remain outstanding. As of June 30, 2021, of the 4,484 outstanding SRPP loans totaling $436.8 million, 1,078 noncompliant loans totaling $100.4 million are in active recovery status, and LOCD represented that current recovery efforts are to either recoup the loan funds or work with the applicants to bring them into compliance with the state?s continuing requirements of the program. The remaining 158 noncompliant loans totaling $14.3 million have been determined by LOCD to be uncollectable for various reasons such as foreclosure, property seizure, or legal dispute. Criteria: OMB Circular A-87, Cost Principles for State, Local, and Indian Tribal Governments, (now located in 2 CFR 225) stipulates that the state assume responsibility for administering federal awards in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to hurricanes Katrina and Rita, the state was awarded and has allocated approximately $653 million to the SRPP, as part of the Road Home program. In accordance with the state?s U.S Department of Housing and Urban Development (HUD)-approved Action Plan Amendment 24, the SRPP offers forgivable loans to qualified property owners who agree to offer rental properties at affordable rents to be occupied by lower-income households. In exchange for accepting loans ranging between $10,000 and $100,000 per rental unit, property owners are required to accept limitations on rents and incomes of renters during an ?affordability period,? a specified period of time based on the amount of funding received and the type of work being done (renovation or full construction) ranging between three and 20 years. The loan amounts are determined based on location of property, number of bedrooms, and the poverty level of the renter. In addition to accepting limitations on rents and income of renters, property owners also agree to maintain property insurance and maintain flood insurance, if necessary. These requirements become effective one year after the closing date and remain until the expiration of the ?affordability period.? According to the loan agreements, failure to comply with any of the loan requirements shall constitute default and mandatory repayment. Good internal controls would ensure that policies and procedures are in place with an established timeline to monitor compliance with the loan agreements and provide for specific actions (i.e., loan modification, foreclosure, or repayment) if a property owner fails to comply with the loan agreement or does not provide evidence of compliance as required by the loan agreement. Cause: In June 2016, HUD issued a monitoring review report with a finding that the SRPP design lacked sufficient fiscal accounting controls and procedures to ensure that CDBG funds identified as ineligible expenses are able to be recaptured and repurposed for eligible uses. Since that time, there have been several monitoring reports indicating progression in this area. In its July 2021 monitoring report, HUD stated that LOCD continues to make gradual progression through its current recapture and reclassification efforts to reduce its overall repayment amount. In its response to that report, LOCD provided an update on the status of the remaining noncompliant properties as it continues to work with HUD to identify a solution for these properties. Effect: Ultimately, LOCD?s failure to recover loans from noncompliant property owners could result in disallowed costs. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of the awards. Recommendation: LOCD should continue its monitoring to identify awards to be placed in recovery and continue the corrective actions as recommended by HUD to recover funds from noncompliant property owners. Management?s Response and Corrective Action Plan: LOCD stated in its response that it will continue the efforts to recover ineligible awards and will continue to work with rental property owners to become compliant and resolve loan compliance issues to reduce or eliminate the need to recapture funds from rental property owners (B-15).

2021-013 ? Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act Award Years: 2016, 2021 Award Numbers: B-16-DL-22-0001, B-21-DC-22-0001 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Division of Administration, Office of Community Development, Local Government Assistance (OCD-LGA) and LOCD did not comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the CDBG Program. During fiscal year 2021, OCD-LGA approved 32 subawards totaling approximately $23 million 31 different subrecipients and LOCD approved 14 subawards totaling approximately $74 million to 11 different subrecipients. Our procedures identified the following: ? In a sample of nine OCD-LGA subawards, none of the nine subaward obligations were reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) within the required time frame. ? Of the 14 LOCD subawards tested, five subawards were not reported in FSRS. In addition, for two of the 14 subawards tested, LOCD reported an inaccurate obligation date within FSRS. None of the nine obligations reported in FSRS were reported within the required time frame. See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR Part 170, Appendix A, requires the non-federal entity to report to FSRS each obligating action equal to or exceeding $30,000 for a subaward. In addition, the subaward information must be reported no later than the end of the month following the month in which the obligation was made. 2 CFR Part 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with relevant requirements. Cause: OCD-LGA management represented that staffing and scheduling conflicts caused the agency to submit required FFATA reports untimely in FSRS. For LOCD, management stated that the infrequency of preparation and review of the FFATA reports caused the required FFATA reports to be missing information and to be submitted untimely to FSRS. Both OCD-LGA and LOCD did not maintain adequate internal controls to ensure compliance with FFATA reporting requirements. Effect: Not complying with the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding OCD-LGA and LOCD?s administration of federal awards. Recommendation: OCD-LGA and LOCD management should establish and implement adequate internal controls to ensure compliance with FFATA reporting requirements, which includes the timely submission of complete and accurate information. Management?s Response and Corrective Action Plan: Management agreed with the auditor?s observations and provided a corrective action plan (B-17).

2021-014 ? Restore Louisiana Homeowner Assistance Program Awards Identified for Grant Recovery Award Year: 2016 Award Number: B-16-DL-22-0001 Compliance Requirement: Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2021, the Division of Administration, Louisiana Office of Community Development (LOCD) identified $901,739 in noncompliant Restore Louisiana Homeowner Assistance Program (RLHAP) awards for 58 homeowners through established program implementation and monitoring procedures for the CDBG Program. Since LOCD has not recovered these noncompliant awards at year-end, we consider these amounts to be questioned costs. As of June 30, 2021, $651,111,383 in total RLHAP awards have been disbursed to 17,160 homeowners. LOCD is actively reviewing 36 files totaling $775,032 to make final determinations of the homeowner?s noncompliant status. At year-end, LOCD reported that 263 homeowner files totaling approximately $5 million have been reviewed through its monitoring procedures. Of the 263 homeowners, LOCD reported that 94 homeowners were placed in recapture status, 141 homeowners were cleared through the review process, 10 homeowners returned their grant award, in whole or in part, and 18 homeowners entered into repayment plans. Criteria: 2 CFR 200, Subpart E, Cost Principles, stipulates that the state assumes responsibility for administering federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to the March and August Floods of 2016, the state was awarded approximately $1.07 billion to administer the RLHAP. In accordance with the state?s HUD-approved Action Plan, eligible homeowners must enter into grant agreements with the state which require homeowners to comply with program requirements in exchange for compensation to rehabilitate or reconstruct their damaged property. Homeowners have three program options to choose from based on their progress in the rebuilding process and their capacity to complete their home repair or reconstruction. Eligibility and grant award calculations are determined based on information provided by the homeowner, the results of field inspections, and available third-party datasets. Once eligibility has been established and award amounts have been calculated, funds are awarded to the homeowner upon the effective date of signing the grant agreement, which is referred to as the closing date. Should homeowners experience a change in the circumstances after grant determination or if additional information becomes available after closing, homeowners? grant calculation or program eligibility may change. In the event the change reduces their amount of eligible funding, RLHAP may require that a homeowner return all or a portion of their award. Cause: Circumstances that may result in homeowners being required to repay all or a portion of the award include: duplicative benefits received but not included in initial grant award calculation, information discovered identifying the homeowner as ineligible for the award received, failure to complete construction per program requirements, substantial noncompliance with requirements of grant agreements, voluntary withdrawal from the program, or discovery that the homeowner provided false or misleading information during the grant award process. Effect: If LOCD is unable to recover benefits from noncompliant homeowners, disallowed costs could result. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of these awards. Recommendation: LOCD should continue its monitoring to identify awards to be placed in recovery and continue recovery efforts to collect those awards determined to be noncompliant. Management?s Response and Corrective Action Plan: LOCD agreed that the identified files have been placed in recapture and stated it will continue to follow the established recapture procedures for these grant awards to ensure ultimate compliance (B-18).

2021-015 - Noncompliance with Certain Subrecipient Monitoring Requirements Award Year: Not Applicable Award Number: Not Applicable Compliance Requirement: Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Coastal Protection and Restoration Authority (CPRA) did not comply with certain subrecipient monitoring requirements for Gulf of Mexico Energy Security Act (GoMESA) program funds disbursed. Within its agreements with coastal political subdivisions (CPSs) for the use of GoMESA funds, CPRA did not identify to the CPSs that they are subrecipients of the funding or communicate the GoMESA assistance listing number to the CPSs. In addition, while CPRA appears to have conducted an informal risk assessment process in determining the project monitoring to be performed on each GoMESA project, this risk assessment process was not documented. Lastly, CPRA did not establish a process to ensure that CPSs receiving GoMESA funds obtain a Single Audit, if required by Uniform Guidance, nor did CPRA establish a process to obtain the CPSs Single Audit reports to review for GoMESA findings. Criteria: GoMESA funds are received by the state of Louisiana annually without an accompanying grant award document, which is typically the document that identifies the applicable federal requirements the recipient agency must comply with. Absent an award document, the auditors used the GoMESA Act and the Assistance Listing (15.435) to identify applicable compliance requirements. The Assistance Listing states that 2 CFR 200, Subpart D, Post Federal Award Requirements, applies to GoMESA funds. Within this subpart, federal regulations require CPRA to make case by case determinations of whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor using the criteria outlined within 2 CFR 200.331. Further, 2 CFR 200.332 outlines certain requirements that entities making subawards must comply with. Cause: CPRA?s GoMESA agreements with CPSs are for activities ranging from infrastructure construction, levee improvements, engineering and design, and real estate acquisition. CPSs enter into agreements with construction, engineering and design, and real estate vendors to provide services required to complete each project. CPSs receiving reimbursement from CPRA under the GoMESA program have been considered contractors by CPRA. Based on the auditor?s application of the criteria outlined in 2 CFR 200.331 and using our professional judgment, we concluded that the agreements created subrecipient relationships between CPRA and the CPSs. The auditor?s conclusion is mainly based on the agreements requiring CPSs to adhere to applicable federal program requirements on its use of GoMESA funds. In addition, the CPSs use the funds to carry out the public purpose of completing hurricane protection projects as specified in the GoMESA Act of 2006. CPRA stated that the lack of a federal award document for GoMESA funds resulted in uncertainty of which federal requirements CPRA is required to comply with and CPRA had not identified subrecipient requirements as applicable to GoMESA funds. CPRA contends that the GoMESA funds received by CPRA are not an ?award? and, therefore, the criteria outlined in 2 CFR 200.331 cannot be applied to the agreements with CPSs for the purpose of determining a subrecipient or contractor relationship. CPRA and the auditors are currently seeking clarification from the federal agency disbursing GoMESA funds as to the applicability of subrecipient requirements. Effect: Not complying with federal subrecipient monitoring requirements increases the likelihood of disallowed costs and can result in inaccurate reporting of expenditures on the SEFA. Of the $73.8 million in GoMESA expenditures reported by CPRA on the 2021 SEFA information submitted to the Division of Administration, $60,974,812 was for payments to CPSs and was not listed as amounts provided to subrecipients. Recommendation: CPRA should continue to pursue clarification on this issue and establish procedures to evaluate current and future GoMESA agreements with CPSs to ensure compliance with relevant requirements. Management?s Response and Corrective Action Plan: Management did not concur with the finding (B-7). Auditor?s Additional Comments: Management?s response stated, ?the auditor acknowledges that there is continued uncertainty regarding the applicability of subrecipient requirements? since the finding acknowledges seeking additional clarification from the federal agency. We contend that the provisions of 2 CFR 200 (Uniform Guidance) noted as applicable in the Assistance Listing should be applied unless specific guidance from the federal government states otherwise. As noted in the finding above, absent an award document, the auditors used the available federal program information for GoMESA to identify applicable compliance requirements for use of the funds. Management?s response indicated the auditor?s determination was made, ?based on an April 7, 2022 phone call from staff at the Office of Natural Resources Revenue.? The response stated, ?Since this latest guidance occurred nearly one year after the period for which this audit was conducted, we question the basis for which CPRA is being issued a reportable finding.? We would like to clarify that as communicated to CPRA management, our determination is based on the latest official guidance from the U.S. Department of the Interior, Office of Natural Resources Revenue (ONRR), in a letter dated January 21, 2021, confirming to CPRA that ?GOMESA funds are federal financial assistance? and that all applicable federal requirements apply. This was in response to a letter from CPRA to the U.S. Department of the Interior dated July 28, 2020, asking for confirmation that GoMESA funds are federal financial assistance in accordance with the Assistance Listing. That letter also stated that, ?CPRA is adhering to all associated and applicable requirements of 2 CFR 200.? Based on this response to CPRA from ONRR, CPRA reported GoMESA funds on the SEFA, as required by Uniform Guidance; however, it did not apply the subrecipient monitoring requirements that are also required by Uniform Guidance. Lastly, management explained that its ?position remains that until there is clear written guidance from the appropriate federal agency that subrecipient monitoring is a requirement, CPRA cannot be in noncompliance given that 2 CFR 200 affords the recipient agency the ability through a prescribed analysis to make that determination.? While Uniform Guidance requires CPRA to make determinations of whether each agreement funded with GoMESA casts the receiving party in the role of a subrecipient or a contractor, the auditor is required to review and evaluate CPRA?s determination. As noted above, based on the auditor?s application of the Uniform Guidance criteria and using our professional judgment, we concluded that the agreements created subrecipient relationships between CPRA and the CPSs.

2021-016 - Inadequate Controls over Interstate Billing and Employer Charging Requirements Award Year: Not Applicable Award Number: Not Applicable Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LWC did not have adequate controls in place to ensure discrepancies in information received from other states for unemployment compensation claims were adequately resolved in a timely manner. Based on our audit procedures, LWC did not charge employers associated with 10 (17%) of 60 interstate claims tested from a population of 45,462 interstate claims from ?paying states.? Although LWC transferred information about wages earned with these employers, made a determination regarding their liability, and paid the related bills promptly, the employers for these claims were not charged because of discrepancies in the claim that may require the ?paying state? to correct. Controls in LWC?s Helping Individuals Reach Employment (HiRE) system prevent employers from being charged until such discrepancies are investigated and resolved. However, controls should be strengthened to ensure that unresolved issued are followed up on in a timely manner. Discrepancies were investigated and resolved after LWC was notified by the auditor of the errors found. Criteria: The U.S. Department of Labor (USDOL)?s ET Handbook No. 399, Section V (Rights and Responsibilities of the Transferring State) explains that reimbursement in the amount shown at the bottom of Form IB-6 (Statement of Benefits Paid to Combined Wage Claimants) is due and payable upon receipt of the charge statement. Further, when charges cannot be accounted for, the agencies involved should immediately attempt to settle the dispute. R.S. 23:1541 states the administrator shall render a statement to each employer of benefits paid each individual and charged to his experience-rating record. Chargeability is not altered unless such decision is reversed by administrator, administrative law judge, or court. These decisions shall be binding upon the employer upon his receipt of the quarterly statement of benefit charges. R.S. 23:1551 states the administrator shall take all necessary steps to correct and rectify administrative errors, if not later than three years from the date of error. The state of Louisiana participates in the Interstate Benefit Payment Plan, which is an interstate agreement that allows an unemployed worker with employment and wages in more than one state to elect to combine his or her wages from all such states in order to satisfy the wage qualification requirements of the ?paying state,? or as a means of increasing his or her weekly or maximum benefit amount. The states where the wages are earned (?transferring states?) are charged for the unemployment paid by the ?paying state? based on the proportion of wages earned in each state. Transferring states are responsible for paying interstate charges upon receipt, but when charges cannot be accounted for, the agencies involved should immediately attempt to settle the dispute. All State Workforce Agencies utilize the Interstate Connection Network (ICON) provided by the USDOL to facilitate the exchange of information needed to process Interstate Benefits, Combined Wage Claims, and other Unemployment Insurance related information between states and to coordinate the payment of these claims with other states. LWC?s HiRE system interfaces with the ICON system to meet these requirements. As a part of this process, LWC charges affected employers their proportionate share of the total claim in accordance with state law. Cause: LWC does not have adequate procedures in place to follow-up on unresolved issues. Management indicated the volume and complexity of interstate charges during the pandemic inhibited its ability to effectively perform certain procedures, and it was operating with limited staff and experience due to turnover and vacancies during this time. Effect: Failure to investigate and resolve discrepancies in a timely manner could result in improper payments to states, improper charges to employers? accounts, or noncompliance with federal regulations. Recommendation: LWC management should ensure discrepancies in interstate claims information are investigated and disputed, as necessary. These procedures should include reviewing billing quarters affected by the pandemic for other possible errors or unresolved issues, and further investigating the cause to ensure matters are adequately resolved and employers are properly charged. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-94).

2021-017 - Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act Award Years: 2018 ? 2020 Award Numbers: AA322011855A22, AA332321955A22, AA347712055A22 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LWC did not comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Workforce Investment Opportunity Act (WIOA) Cluster programs. During fiscal year 2021, LWC disbursed approximately $50.6 million in subawards to 15 different subrecipients. These subawards account for approximately 86% of the programs? fiscal year 2021 expenditures. Criteria: 2 CFR 170, Appendix A(I)(a), requires the non-federal entity to report to the FFATA Subaward Reporting System (FSRS) each obligating action equal to or exceeding $30,000 for a subaward. Cause: LWC management indicated that turnover in agency personnel caused the subaward information to not be reported as required. Effect: Not uploading obligating actions to the FSRS could result in a citizen or federal official having a distorted view as to how LWC is obligating federal funds. Recommendation: LWC should assign appropriate personnel to complete the necessary FFATA reporting requirements in accordance with federal requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-95).

2021-018 ? Noncompliance with Requirements for the Reemployment Services and Eligibility Assessment Program Award Year: Not Applicable Award Number: Not Applicable Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LWC did not administer the Reemployment Services and Eligibility Assessment (RESEA) program in accordance with federal regulations. The March 2021 and June 2021 quarterly progress reports submitted by LWC to the USDOL reported a combined 5,081 (60%) out of 8,428 identified participants who did not respond or could not be contacted in the month that they were identified for the program. LWC did not take further action on the 5,081 claimants to adjudicate the claims to determine if UI benefits should be discontinued. Criteria: The RESEA program is authorized by Section 306 of the Social Security Act, and the USDOL is the federal grantor. The USDOL provides annual guidance to state workforce agencies in the Unemployment Insurance Program Letter (UIPL). UIPL Number 13-21, which provides operating guidance for fiscal year 2021, states that participation in the RESEA program is mandatory as a condition of continued UI eligibility. If a participant fails to participate in the program, their claim must be referred for adjudication. Cause: LWC management represented that RESEA operations and personnel were impacted by changes necessitated by the COVID-19 pandemic. As a result, resources and efforts were focused on those UI claimants who responded to the LWC profiling. Effect: LWC is not compliant with RESEA program requirements which could result in UI payments being made to claimants who are no longer eligible. Recommendation: LWC should take steps to ensure the RESEA program is administered fully as those identified participants not entering the program should be sent to adjudication for review of continued UI eligibility. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and outlined a plan of corrective action (B-96).

2021-019 - Noncompliance with Subrecipient Monitoring Requirements Award Years: 2018 ? 2020 Award Numbers: AA322011855A22, AA332321955A22, AA347712055A22 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2020-014) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, LWC did not adequately monitor subrecipients under the Workforce Innovation and Opportunity Act (WIOA) Cluster programs. WIOA program expenditures totaled $58.8 million during fiscal year 2021, with approximately $50.6 million provided to subrecipients who were not adequately monitored. Audit procedures identified the following: ? LWC did not conduct annual monitoring reviews of its subrecipients for compliance with federal laws and regulations. During fiscal year 2021, reviews were conducted for only one of the 15 subrecipients and this review related to fiscal year 2019 program activity. ? LWC did not finalize monitoring reviews for subrecipients in a timely manner. LWC?s policy requires monitoring reviews to be completed, including resolution of any findings and issuance of close-out letters, within five months of the issuance of the monitoring reports. For 13 (87%) of the 15 monitoring reports issued during fiscal year 2020, final determinations were made between six and 18 months after the report issuance. In addition, as of December 31, 2021, final determination has not been made for one (7%) of the 15 reports. ? LWC did not have the controls in place to ensure that required audits of subrecipients were completed timely and that subrecipients provided appropriate corrective action for any findings issued. LWC?s documentation did not contain evidence to support the reviews were performed timely. In addition, LWC marked three of the 15 audit reports as requiring corrective action plans, but have not requested this information from the subrecipients. Further, one (7%) of the 15 audit reports was issued 18 months after fiscal year end. Criteria: 2 CFR 200.332(d) requires that pass-through entities monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. 2 CFR 200.332(d)(2) requires that pass-through entities follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies provided to the subrecipient from the pass-through entities detected through reviews. 20 CFR 683.410(b)(2) requires that LWC?s monitoring system provide for annual on-site monitoring reviews of its subrecipients? compliance with the federal uniform administrative requirements. 2 CFR 200.501(b) requires a single audit for a non-federal entity that expends $750,000 or more during the entity?s fiscal year. 2 CFR 200.512(a) requires that the single audit must be submitted within the earlier of 30 calendar days after receipt of the audit report or nine months after the end of the audit period. OMB Memorandum (M-21-20) dated March 19, 2021, Promoting Public Trust in the Federal Government through Effective Implementation of the American Rescue Plan Act and Stewardship of the Taxpayer Resources, Appendix 3, Section IX, allowed subrecipients a six-month extension of single audit submissions beyond the normal due date. 2 CFR 200.521(d) requires pass-through entities to issue a management decision on applicable audit findings within six months after receipt of the subrecipient?s audit report and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. LWC?s Policy Number OWD 4-12 requires monitoring reviews to be completed, including resolution of any findings and issuance of close-out letters, within 5 months of the issuance of the monitoring reports. Cause: LWC management indicated there were multiple issues that impacted its ability to perform adequate subrecipient monitoring including a significant workload in the close out of the 2020 reviews of the fiscal year 2018 program activity, turnover in management and staff personnel with new staff needing to be trained, and local offices being closed and working remotely for part of the year. Effect: Failure to perform adequate monitoring impairs LWC?s ability to ensure that program funds passed through to its subrecipients are spent in accordance with program regulations and increases the risk of improper payments, which LWC may have to repay to the federal grantor. Recommendation: LWC management should ensure that annual audits and monitoring reviews are performed for all subrecipients as required by federal regulations. In addition, management should ensure that audit resolution is performed timely for all required audits. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and outlined a plan of corrective action (B-98).

2021-020 - Unexecuted Source Code Escrow Agreement Award Year: Not Applicable Award Number: Not Applicable Compliance Requirement: Other Repeat Finding: Yes (Prior Year Finding No. 2020-013) See Schedule of Findings and Questioned Costs for chart/table Condition: LWC did not have a fully-executed contract with Geographic Solutions, Inc. (GSI) to provide for extended escrow services between LWC and GSI. LWC contracts with GSI as a sole source provider of the Helping Individuals Reach Employment (HiRE) system. The HiRE system is used to administer the state?s UI program, and GSI performs critical services without which LWC could no longer operate the program. This is the fifth consecutive audit that LWC?s contract with GSI lacks an adequate and fully executed source code escrow agreement. Criteria: Good internal controls over information technology contracts should ensure all key terms in an agreement are executed to protect the entity upon contractual default of the contractor. Cause: An amended contract with GSI was signed in October 2020, and later amended in November 2021, to provide for these services. However, as of November 2021, the escrow fees had not been paid and the source codes had not been provided to the escrow agent. Effect: LWC may be unable to use the source code in the event of GSI?s contractual default. Recommendation: Management should take the actions necessary to ensure the escrow service agreement is fully executed. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-101).

2021-021 ? Inadequate Controls over Payroll Award Year: 2020 Award Number: Not Applicable Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Louisiana Department of Health (LDH), Office of Behavioral Health (OBH), did not ensure payroll expenditures were approved in accordance with agency policy. These expenditures were submitted to the Division of Administration (DOA) for reimbursement by the Coronavirus Relief Fund (CRF) program. In a non-statistical sample of 40 payroll timesheets from a population of 30,582 transactions submitted by LDH for reimbursement totaling $69,440,828, we noted three (8%) instances at Central Louisiana State Hospital and Eastern Louisiana Mental Health System where payroll documentation was not approved by the payroll posting date as required by agency policy and used to request reimbursement from DOA. Criteria: 2 CFR 200.430(i) requires that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed, and these records must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. OBH payroll policies require supervisors to approve timesheets and supporting documentation in a timely manner. Cause: OBH lacked sufficient controls to ensure all payroll timesheets were properly supported, in accordance with federal regulations and agency policy, and approved prior to the payroll posting date. Effect: Failure to maintain adequate supporting documentation, including proper approvals of program expenditures, increases the risk that unallowable costs could be reimbursed by the federal grantor. Recommendation: OBH should ensure employees comply with existing policies and procedures, including properly approving timesheets in a timely manner and maintaining adequate documentation to support all expenditures of federal awards. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-36).

2021-022 ? Control Weaknesses over Compliance with Coronavirus Relief Fund Requirements and State Laws Award Year: 2020 Award Number: Not Applicable Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Louisiana Department of the Treasury (Treasury) did not consistently follow its policies and procedures for all grants awarded through the Main Street Recovery Program (Program), which provided reimbursement from the federal CRF to eligible Louisiana businesses for their COVID-19-related expenses, including business interruption. During the fiscal year ended June 30, 2021, Treasury awarded 20,705 grants totaling $262 million. In a non-statistical sample of 71 grants totaling $915,417 that were disbursed to recipients during the fiscal year ended June 30, 2021, we identified the following exceptions: ? Nine (13%) recipients had other federal awards according to various federal databases which were not reported by the recipients in their applications and had not been identified by Treasury?s program staff in calculating the eligible grant awards. To limit the risk of recipients receiving multiple federal awards for the same expenses (duplication of benefits), which is prohibited by federal CRF regulations, the Program?s procedures require staff to independently check certain federal databases to verify whether the applicant had other approved federal awards. Those other federal awards should have reduced the applicant?s COVID-19-related expenses in determining the final award amount unless the applicant provided documentation that those other federal awards were declined. Because each applicant grant was capped at $15,000 of their eligible COVID-19-related expenses, only two of these nine exceptions have the potential of duplicating benefits of $8,100 (0.9% of sample), which is included in questioned costs for awards in recovery status as described below. ? One (1%) recipient?s grant was based on expenses reported on a tax return without Program staff verifying the return was actually filed with the Louisiana Department of Revenue (LDR), as required by Program policies. The record provided by LDR indicated the recipient had not filed the tax return used for the award determination. As a result, the recipient is ineligible for the $15,000 (1.6% of sample) grant, which is included in questioned costs for awards in recovery status as described below. Treasury ceased awarding grants in January 2021 upon exhausting the Program?s appropriation by the Louisiana Legislature of the CRF monies received by the state of Louisiana. Treasury?s post-disbursement grant review process included agreed-upon procedures performed by the Louisiana Legislative Auditor?s Recovery Assistance Services (RAS) and reviews performed by Treasury?s staff. These post-disbursement grant reviews identified ineligible recipients and unsupported award amounts due to various issues such as insufficient documentation, failed validation of tax return with LDR, errors in award calculations, potential duplication of benefits, or potential recipient fraud. A RAS report dated April 15, 2021, identified unresolved exceptions totaling $1,158,596 (1.32%) relating to applicant ineligibility and unsupported expenses from samples totaling $87,792,565. In addition to the awards identified with unresolved exceptions in the RAS report, Treasury?s records indicate awards totaling $783,999 were identified by Treasury?s staff that were disbursed to ineligible recipients or had unsupported award amounts. For these awards totaling $1,942,595 identified during Treasury?s post-disbursement award review process, Treasury performed and continues to perform outreach efforts to resolve the issues with the recipients by requesting missing documentation or sending demand letters requesting the return of funds. Treasury?s records indicate that as of March 11, 2022, awards totaling $880,710 have been resolved, and awards totaling $1,061,885, or 0.4% of the total grants awarded, remain in recovery status without resolution and are considered questioned costs. Criteria: Treasury developed its Program policies and internal controls to ensure compliance with the federal CRF regulations and the additional regulations established for the Main Street Recovery Program in R.S. 39:100.44. Good internal controls require the established controls be followed consistently prior to disbursing the grant to the recipient. Cause: Based on the results of our sample and Treasury?s own post-disbursement grant review process, both described above, Treasury?s management did not ensure controls were consistently followed prior to disbursing payment to grant recipients. Effect: Failure to ensure internal controls are consistently followed increases the risk of noncompliance with state and federal regulations. Noncompliance with federal CRF regulations may result in the federal awarding agency disallowing those costs and the state of Louisiana having to repay the federal government. Recommendation: Treasury should continue its post-disbursement grant review processes for identifying awards that fail to comply with the Main Street Recovery Program policies and continue efforts to resolve the compliance issue and/or recover the funds from the recipients. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-66).

2021-023 - Higher Education Emergency Relief Fund Reporting Weaknesses Award Year: 2021 Award Numbers: P425E201230, P425F201239, P425L200162 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Baton Rouge Community College (BRCC) did not ensure the accuracy of quarterly reports for the Higher Education Emergency Relief Funds (HEERF) program and did not ensure the reports were publicly posted by the required deadlines. The Quarterly Public Reporting for Institutional and Minority Serving Institutions (MSI) portions for the quarter ending June 30, 2021, was publicly posted 61 days after the required due date. In addition, the Institutional portion total quarterly expenditures for the quarter ending June 30, 2021, did not agree to the underlying documentation. The MSI total quarterly expenditures for the quarters ending March 31, 2021, and June 30, 2021, did not agree to the underlying documentation. BRCC subsequently revised the reports after auditor inquiry. The Quarterly Public Reporting for Student Aid Portion for the quarters ending March 31, 2021, and June 30, 2021, were publicly posted 219 and 209 days, respectively, after the required due dates, following auditor inquiry. Criteria: The Coronavirus Aid, Relief, and Economic Security (CARES) Act, Section 18004(e), and the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA), Section 314(e), requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. Per the U.S. Department of Education (USDOE) form instructions, BRCC must post the Quarterly Public Reporting for Institutional and MSI portions no later than 10 days after the end of each quarter on its website. Per the May 13, 2021, Federal Register, institutions must publicly post its initial report for the CRRSAA Student Aid Portion as soon as possible, but no later than 30 days after the publication of the notice. The USDOE further indicated that institutions have until June 30, 2021, to post the retroactive reports. Cause: BRCC did not have adequate controls in place to ensure the accurate preparation of the reports or to ensure that the reports were publicly posted by the required deadlines. Effect: Failure to ensure the accuracy of quarterly reports for the HEERF program and to ensure the reports were publicly posted by the required deadlines resulted in noncompliance with federal regulations. Recommendation: Management should strengthen its procedures over the preparation and public posting of quarterly reports for the HEERF program to ensure compliance with reporting requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-2).

2021-024 - Inadequate Controls over Return of Title IV Funds Award Years: 2020, 2021 Award Numbers: P063P195473, P063P205473, P268K215473 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-022) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive audit, BRCC did not have adequate controls in place to ensure that returns of Title IV funds were accurately calculated and timely returned to the USDOE as required by federal regulations. In a non-statistical sample for the Summer 2020 semester of four students from a population of 379 who were evaluated by BRCC for return of Title IV funds, one (25%) return calculation was inaccurate, resulting in $46 being owed back to the USDOE. Also, two (67%) of three required returns were not returned to the USDOE within 45 days of determining the student?s withdrawal dates as required by federal regulations. The late returns were 28 days after the required 45-day period. In a non-statistical sample for the Fall 2020 semester of 27 students from a population of 1,609 who were evaluated by BRCC for return of Title IV funds, three (11%) return calculations were inaccurate, resulting in $81 being improperly returned to the USDOE and $1,095 being owed back to the USDOE. Also, one (5%) of 20 required returns was not returned to the USDOE within 45 days of determining the student?s withdrawal dates as required by federal regulations. The late return was 64 days after the required 45-day period. In a non-statistical sample for the Spring 2021 semester of 29 students from a population of 1,682 who were evaluated by BRCC for return of Title IV funds, three (10%) return calculations were inaccurate, resulting in $1,622 being owed back to the USDOE. Criteria: 34 CFR 668.22(a)(1) requires the institution to determine the amount of Title IV funds that the student earned as of the student?s withdrawal date. 34 CFR 668.22(j) requires the institution to return unearned Title IV funds within 45 days of the determination date of withdrawal. 34 CFR 668.22(f) defines how the percentage of the period of enrollment completed is calculated, including the total number of days in the period of enrollment, except scheduled breaks of at least five consecutive days are excluded from the total number. Cause: Management noted the returns were untimely for the Summer 2020 and Fall 2020 semesters because the returns were held for processing in a larger batch. Inaccurate return calculations were the result of incomplete institutional charges included in the return calculations and incorrect percentages earned. Management's response to the prior-year finding indicated it would implement corrective action by September 2021 and were in the process of implementing the additional controls during the fiscal year under audit. Effect: Failure to timely and accurately perform return of funds calculations and remit the related funds to the USDOE results in noncompliance with federal regulations and can result in improper billings to students and/or a loss of funds by BRCC. Recommendation: Management should strengthen controls to ensure any unearned funds by withdrawn students are accurately calculated by ensuring the institutional charges included in the return calculations are complete and the percentages earned are correct; and returns to the USDOE are completed within the required time frames. Management also should adjust all applicable student accounts in the Banner System for the inaccurate returns. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-3).

2021-025 - Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security Award Year: 2021 Award Numbers: P063Q203649, P268K213649 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Bossier Parish Community College (BPCC) did not have a formal documented risk assessment or related safeguards that address the following minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information: ? Employee training and management; and ? Information systems including network and software design, as well as information processing, storage, transmission and disposal. BPCC has information technology policies and practices that require employee training, information technology security policies and procedures, a documented disaster recovery plan, and password policy, but has not performed a formal documented risk assessment including safeguards to address identified risk as required by federal regulations. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program, (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards' key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: BPCC did not perform a formal risk assessment including safeguards to address identified risks. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information and results in noncompliance. Recommendation: Management should develop, implement, and maintain information security programs that include a formal documented risk assessment specific to the Gramm-Leach-Bliley Act and implement safeguards to control the risks identified in regards to student information. Management?s Response and Corrective Action Plan: Management did not concur with the finding (B-4). Auditor?s Additional Comments: Management?s response describes a tool used to address employee training and management, as well as regular cybersecurity scans, which are risk measurement tools; however, it is not a risk assessment. Management?s risk assessment needs to be documented and specific to the Gramm-Leach-Bliley Act.

2021-026 - Noncompliance with Borrower Data Reconciliation Requirements Award Year: 2021 Award Number: P268K212530 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-026) See Schedule of Findings and Questioned Costs for chart/table Condition: Delgado Community College (Delgado) did not properly reconcile the School Account Statement (SAS) data files to the institution?s financial records on a monthly basis for the Federal Direct Student Loans program. Each month, the USDOE?s Common Origination and Disbursement (COD) system provides the institution the SAS data files, which should reconcile back to the G5 system Draw Down reports and the institution?s financial records to ensure the institution has transmitted accurate and complete student data to the COD system for all Federal Direct Student Loan borrowers in accordance with federal requirements. During fiscal year 2021, audit procedures revealed that eight of 12 monthly reconciliations were not completed timely and did not include documentation for unreconciled differences in student disbursements between the G5 system and the COD system. Criteria: 34 CFR 685.300(b)(5) requires that institutions must, on a monthly basis, reconcile institutional records with Federal Direct Student Loan funds received and disbursement records submitted to and accepted by the USDOE. Per the 2020-2021 Federal Student Aid (FSA) Handbook (Volume 4, Chapter 6), a school that participates in the Federal Direct Student Loan Program is required monthly to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the COD system. Cause: Delgado did not have adequate controls in place to ensure adherence with federal regulations in its performance of monthly reconciliations of Federal Direct Student Loan receipts and disbursements. Effect: Failure to set prescribed controls to perform the SAS data file monthly reconciliation places Delgado in noncompliance with federal regulations and could result in Delgado reporting inaccurate information to the COD system. Recommendation: Management should strengthen its controls to ensure Delgado properly performs monthly reconciliations of the G5 system to the COD system and properly document the resolution of differences in the disbursement information between Delgado and the COD system. Management?s Response and Corrective Action Plan: Management did not concur with the finding of noncompliance for July 2020 through February 2021 because of the following: (1) the preferred approach used for March 2021 through June 2021 that was accepted is not a federal requirement, (2) the preferred approach was not communicated by the auditors until March 2021, (3) the college should not be held in noncompliance for the months prior to communication from the auditor, and (4) the PDF monthly reconciliation report approach used by Delgado for July 2020 through February 2021 does produce a list of monthly variances (B-10). Auditor?s Additional Comments: Although management took corrective action in March 2021, Delgado was not in compliance with federal regulations for eight months of fiscal year 2021. Management mentions that the PDF documentation produced in the Banner system during the monthly reconciliation process for these eight months complies with federal requirements. As part of our procedures, we requested reconciliations for two of these eight months; however, management could not provide documentation of proper reconciliations between the G5 system and the COD system for the period prior to March 2021 that includes support for unreconciled differences. Management also mentions that the FSA Handbook does not mandate or prescribe any particular method of documenting differences; however, per the FSA Handbook, schools should identify, resolve, and document all discrepancies and track those that are due to timing.

2021-027 - Noncompliance with Reporting Requirements for the Federal Funding Accountability and Transparency Act Award Years: 2018 - 2020 Award Numbers: S010A180018, S010A190018, S010A200018, S425D200003 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Education (DOE) did not comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Title I Grants to Local Educational Agencies (Title I) and Education Stabilization Fund (ESF) programs. Our procedures disclosed the following: ? For Title I, no subaward information was entered into the FFATA Subaward Reporting System (FSRS) for 554 subawards of $30,000 or more totaling $913,820,832, related to three separate federal awards. See Schedule of Findings and Questioned Costs for chart/table ? For the ESF Elementary and Secondary School Emergency Relief Fund, a test of 76 subawards totaling $28,161,143, related to 20 sub-awardees showed that DOE did not report two subawards totaling $91,372 to FSRS; reported the incorrect obligation date for 19 subawards totaling $2,775,319; and did not submit reports timely for 39 subawards totaling $27,964,450. In addition, DOE reported the amounts for 29 subawards totaling $18,037,310 twice. DOE management became aware of the duplicated subawards and made attempts to correct the issue four months after the report was submitted, but it failed to resubmit the revised report. See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 170, Appendix A(I)(a), requires the non-federal entity to report certain information about each obligating action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity into FSRS no later than the end of the month following the month in which the obligation was made. Cause: DOE management indicated that these reporting issues occurred due to a weakness in internal controls over FFATA reporting, not adequately maintaining a list of federal grants for which FFATA reporting was required, and staff turnover contributing to the incomplete knowledge of FFATA reporting. Effect: Not reporting obligating actions to the FSRS or reporting inaccurate information to the FSRS prevents the public from having access to accurate information on how DOE is obligating federal funds. Recommendation: DOE should strengthen internal controls to ensure that appropriate personnel are aware of the federal programs that are subject to FFATA reporting and assign appropriate personnel to complete the FFATA reporting in accordance with federal requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a plan of corrective action (B-14).

2021-028 ? Inadequate Controls and Noncompliance over Return of Title IV Funds Award Year: 2021 Award Numbers: P063P201521, P268K211521 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Grambling State University (GSU) did not have adequate controls in place to ensure the return of Title IV funds was accurately calculated and returned to the USDOE as required by federal regulations. In a non-statistical sample of 40 students from a population of 618 students who were evaluated for return of Title IV funds, two (5%) students had an incorrect withdrawal date used in the calculation of return of Title IV funds, resulting in $6,533 of Federal Direct Student Loan funds and $6,345 of Federal Pell Grant Program funds being owed back to the USDOE and the students? accounts were not adjusted. Criteria: 34 CFR 668.22(a)(1) requires the institution to determine the amount of Title IV funds that the student earned as of the student?s withdrawal date. Cause: GSU did not have adequate procedures in place to ensure faculty entered the correct last date of attendance into the Banner system. Effect: Failure to accurately perform return of funds calculations and remit the proper funds to the USDOE results in noncompliance with federal regulations and can result in improper billings to students and/or a loss of funds by GSU. Recommendation: Management should strengthen controls to ensure that all return of funds calculations are performed accurately and in compliance with federal regulations. Management should also identify students with an incorrect withdrawal date, recalculate the return of Title IV amounts, adjust the student account, and return required funds to the USDOE. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a corrective action plan (B-22).

2021-029 ? Noncompliance with Borrower Data and Reconciliation Requirements Award Year: 2021 Award Number: P268K211511 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: GSU management did not ensure that monthly reconciliations of the School Account Statement (SAS) data files to the institutions financial records were performed as required by federal regulations. Each month, the USDOE?s Common Origination and Disbursement (COD) system provides the institution the SAS data file, which should be reconciled to the institution?s financial records to ensure the institution has transmitted accurate and complete student data to the COD system for all Federal Direct Student Loan borrowers in accordance with federal regulations. For five of the 12 months (42%) of fiscal year 2021, GSU did not provide evidence to show that the institution?s financial records were reconciled as required. Criteria: 34 CFR 685.300(b)(5) requires that schools must, on a monthly basis, reconcile institutional records with Federal Direct Student Loan funds received and disbursement records submitted to and accepted by the USDOE. Cause: GSU?s written procedures did not include adequate details to ensure that all of the required reconciliations were performed monthly and that adequate supporting documentation was maintained. Effect: Failure to perform the monthly reconciliations results in GSU?s noncompliance with federal regulations and could result in undetected discrepancies between the institution?s financial records and data in the COD system. Recommendation: Management should revise its written procedures to ensure GSU properly performs and retains required monthly reconciliations and supporting documentation. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-23).

2021-030 ? Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security Award Year: 2021 Award Numbers: P063P201511, P268K211511 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: GSU did not have a formal documented risk assessment or related safeguards that address the minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information: ? Employee training and management; ? Information systems including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing and responding to attacks, intrusions, or other systems failures. GSU has information technology policies and practices that require employee training, Banner system policies and procedures, a documented disaster recovery plan, and password policy. GSU provided evidence of phishing and email monitoring, employee training status, and a disaster recovery exercise, but has not performed a formal documented risk assessment including safeguards to address identified risk as required by federal regulations. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program, (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards' key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: Management represented that due to a turnover in responsible personnel, GSU did not perform a formal risk assessment including safeguards to address identified risks. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information and results in noncompliance. Recommendation: Management should implement and maintain information security programs that include a formal documented risk assessment of relevant areas of operation, and design and implement safeguards to control the risks identified in regards to student information. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-24).

2021-031 - Noncompliance with and Inadequate Controls over Higher Education Emergency Relief Fund Costs Award Years: 2020, 2021 Award Number: P425F200686 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Louisiana State University and A&M College (LSU A&M) improperly requested and received reimbursement from the Higher Education Emergency Relief Fund (HEERF) for costs totaling $40,897 that did not comply with program requirements. In a non-statistical sample of 29 LSU A&M federal HEERF Institutional Portion transactions from a population of 10,789 transactions, one instance (3%) tested was not in compliance with federal activities allowed or unallowed and allowable costs/cost principles requirements regarding lost revenue. LSU A&M received reimbursement for lost revenue related to investment income, which is a source not considered reimbursable per federal program requirements. Criteria: Per Section 314(c) of the Coronavirus Response and Relief Supplemental Appropriations Act, grant awards may be used to (1) defray expenses associated with coronavirus (including lost revenue, reimbursement for expenses already incurred, technology costs associated with a transition to distance education, faculty and staff trainings, and payroll); (2) carry out student support activities authorized by the Higher Education Act that address needs related to coronavirus; and (3) provide financial aid grants to students, which may be used for any component of the student's cost of attendance or for emergency costs that arise due to coronavirus, such as tuition, food, housing, healthcare (including mental healthcare), or childcare. On March 19, 2021, the USDOE published a HEERF I, II, and III Lost Revenue FAQ to provide further clarification regarding the calculation of lost revenue. Listed in the FAQ under Question #4 are the potential sources of lost revenue that are not reimbursable under the HEERF grant programs. Investment income (including endowment and quasi ? endowment revenue) is one of the items listed as not being reimbursable. Cause: LSU A&M did not have adequate controls in place to ensure that lost revenue calculations included only those sources that were reimbursable under HEERF federal requirements. Effect: The exception resulted in total questioned costs of $40,897. Failure to implement adequate controls over the monitoring of transactions charged to the federal HEERF program increases the risk that unallowable costs could be reimbursed by the federal agency. Recommendation: LSU A&M should design and implement controls to ensure it requests reimbursement from HEERF for only those transactions that meet federal program requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-69).

2021-032 - Noncompliance with and Inadequate Controls over Higher Education Emergency Relief Fund Reporting Requirements Award Years: 2020, 2021 Award Numbers: P425E200790, P425F200686 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LSU A&M did not ensure compliance with public reporting requirements of the HEERF for the Institutional and Student Aid Portion funds as established by the USDOE. Exceptions for the required public reporting are as follows: ? LSU A&M did not complete and publicly report the Quarterly Public Reporting for the Student Aid Portion funds for September 30, 2020, December 31, 2020, March 31, 2021 and June 30, 2021. ? LSU A&M incorrectly reported $9.3 million of Student Aid Portion amounts where Institutional Portion amounts were required on the Quarterly Public Reporting form for Institutional Portion funds on the September 30, 2020 report. ? The Quarterly Public Reporting for Institutional Portion funds for the quarter ending December 31, 2020, was publicly posted at least 19 days after the required due date. ? LSU A&M incorrectly categorized $7 million of student tuition exemptions for Summer 2020 and Summer 2021 that were paid from Institutional Portion funds as emergency financial aid grants to students on the June 30, 2021 Quarterly Public Reporting form. These funds should have been reported in the category for tuition discounts. ? Due to the errors made on the September 30, 2020 Institutional Quarterly Public Reporting form, LSU A&M did not accurately report institutional dollars expended toward emergency financial aid grants to students on the Annual Report for period March 13, 2020, through December 31, 2020. LSU A&M did not use any Institutional Portion funds towards emergency financial aid grants to students as of December 31, 2020. Criteria: The Coronavirus Aid, Relief, and Economic Security (CARES) Act, Section 18004(e), and the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA), Section 314(e), require an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. Per the May 13, 2021, Federal Register, for the CRRSAA and the American Rescue Plan, institutions must publicly post the Student Aid Portion information to their website as soon as possible, but no later than 30 days after the publication of the notice or 30 days after the date funds were first obligated under HEERF I, II, or III to the institution for Emergency Financial Aid Grants to Students, whichever comes later. The information in the public reports must also be updated no later than 10 days after the end of each calendar quarter. Per the USDOE form instructions, the institution must post the Quarterly Public Reporting for Institutional portion no later than 10 days after the end of each quarter on its website. In the July 29, 2020, Federal Register, the USDOE posted an information collection request on a data collection form to satisfy HEERF I reporting requirements specified in Section 18004(e) of the CARES Act, which states that an institution receiving HEERF I funds shall submit the report to the secretary due February 8, 2021. Cause: LSU A&M did not have adequate controls in place to ensure the accurate preparation of the HEERF federal program required reports or to ensure that the reports were publicly posted by the required deadlines. Effect: Failure to ensure the accuracy of quarterly reports for the HEERF federal program and to ensure the reports were publicly posted by the required deadlines resulted in noncompliance with federal regulations. Recommendation: LSU A&M should strengthen its controls over reporting of the HEERF Institutional and Student Aid Portion information to ensure compliance with federal program requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-70).

2021-033 - Noncompliance with and Inadequate Controls over Perkins Loan Recordkeeping and Record Retention Requirements Award Year: Various Award Number: P038A001643 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LSU A&M did not have adequate controls in place to accurately maintain active and inactive Federal Perkins Loan records in accordance with federal regulations. In a non-statistical sample of 40 LSU A&M active Perkins Loan student files from a population of 2,114 files subject to Perkins Loans recordkeeping and record retention requirements, repayment schedules for 37 (93%) were not maintained in the fireproof safe in accordance with federal regulations. Of the 37 repayment schedules not maintained in the fireproof safe, one repayment schedule could not be located. In a non-statistical sample of 40 LSU A&M inactive Perkins Loan student files from a population of 1,075 files subject to Perkins Loans recordkeeping and record retention requirements, LSU A&M did not maintain required documentation for five (13%) in accordance with federal regulations. Criteria: Per 34 CFR 674.19(e)(4) An institution shall keep the original promissory notes and repayment schedules until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. Additionally, per 34 CFR 674.19(e)(4)(i) an institution shall keep the original paper promissory note or original Master Promissory Note and repayment schedules in a locked, fireproof container. Per 34 CFR 674.19(e)(3)(ii), an institution shall retain repayment records, including cancellation and deferment requests for at least three years from the date on which the loan is assigned to the Secretary, canceled, or repaid. Cause: LSU A&M did not design and implement adequate controls to ensure that Federal Perkins Loans active and inactive records are properly being maintained in accordance with 34 CFR 674.19(e). Effect: Failure to implement controls over Perkins Loan recordkeeping and record retention could result in the loss of required documentation and noncompliance with federal regulations. Recommendation: LSU A&M should design and implement controls over Perkins Loan recordkeeping and record retention requirements that ensure the federal record retention regulations are being followed and required documentation is being accurately maintained for the time period set forth by the USDOE. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-71).

2021-034 - Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security Award Year: 2021 Award Numbers: P063P201522, P268K211522 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Northwestern State University (NSU) did not have a formal documented risk assessment or related safeguards that address the following minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information: ? Employee training and management; ? Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing, and responding to attacks, intrusions, or other system failures. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program, (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards' key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: Management represented that NSU performed procedures in fiscal year 2021 to provide employees and management with cyber security training, began implementation of MultiFactor Authentication, implement centralized deployment and sanitization of desktop computers, implement regular review of access to the ERP, standardize and implement antivirus software, implement use of Microsoft Safe Links along with OpenDNS and Proofpoint to respond to phishing and malicious URLs, and implement the centralization of servers, storage, and backup. However, management was unable to produce formal documentation to support risk assessments performed and safeguards implemented as required by federal regulations. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk for unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information and results in noncompliance with applicable federal regulations. Recommendation: Management should develop, implement, maintain, and document information security programs that include a formal documented risk assessment of relevant areas of operation as well as design and document safeguards implemented to controls the risks identified related to student information. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-102).

2021-035 - Untimely Return of Title IV Funds Award Year: 2021 Award Numbers: P063P201522, P268K211522 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: NSU did not have adequate controls in place to make required returns of Title IV funding to the USDOE within the time frames set by federal regulations. We reviewed a non-statistical random sample of 40 students from a population of 1,093 students that withdrew from NSU during the Fall 2020, Spring 2021, or Summer 2021 semesters and noted that the required returns of Title IV funding for seven (18%) students were processed through the students? accounts between four and 546 days late. For the seven noted students, a combined $13,214 of required institutional returns were processed late. Criteria: 34 CFR 668.173(b)(1) states that an institution returns unearned Title IV, Higher Education Act program funds timely if the institution deposits or transfers the funds into the bank account it maintains under 34 CFR 668.163 no later than 45 days after the date it determines that the student withdrew. Cause: Management represented that it initiated the Return to Title IV process at the time that the seven students withdrew from NSU and promptly sent notices to the students regarding the reductions to their financial aid. However, the required returns of Title IV funding were not completely processed to the students? accounts in NSU?s systems. Effect: Failure to process a student?s required return in a timely manner resulted in noncompliance with applicable federal regulations and increases the risk that required returns will not be processed. Recommendation: Management should develop and implement procedures that will ensure that all required returns of Title IV funding are processed to students? accounts and returned to the USDOE within the time frames established by applicable federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-103).

2021-036 - Weakness in Calculation of Return of Title IV Funds Award Year: 2021 Award Numbers: P063P201522, P268K211522 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: NSU did not have adequate controls in place to calculate the return of Title IV funds correctly for the Federal Pell Grant Program and Federal Direct Student Loans. Out of a non-statistical random sample of 40 students from a population of 1,093 students that withdrew from NSU during the Fall 2020, Spring 2021, or Summer 2021 semesters, 33 (83%) students from the Fall 2020 or Spring 2021 semesters included the incorrect number of completed days and/or total days. Our review of the 33 affected students indicated that 14 students had differences as a result of the error in their calculation ranging from $7 to $586 and totaling $3,883. Out of this total, $142 is related to a post-withdrawal disbursement that one student qualified for but NSU did not identify and offer to the student. The remaining $3,741 represents an erroneous excess of Title IV funds returned to the USDOE on the students? behalf. Criteria: 34 CFR 668.22(f)(1)(i) states that the percentage of the payment period or period of enrollment completed is determined in the case of a program that is measured in credit hours by dividing the total number of calendar days in the payment period or period of enrollment into the number of calendar days completed in that period as of the student's withdrawal date. 34 CFR 668.22(f)(2)(i) states that the total number of calendar days in a payment period or period of enrollment includes all days within the period that the student was scheduled to complete, except that scheduled breaks of at least five consecutive days are excluded from the total number of calendar days in a payment period or period of enrollment and the number of calendar days completed in that period. Cause: Management represented that it attempted to program its system to calculate the days of attendance and total days in the academic period to properly exclude holiday periods that lasted at least five consecutive calendar days and properly end the academic period on the last day of final exams for the semester. However, the applicable modules used in NSU?s systems were not properly designed to ensure that the days of attendance and total days in the academic period were calculated as required by federal regulations. Effect: Failure to accurately calculate the required return of Title IV funds by adhering to the provisions of 34 CFR 668.22(f) resulted in a failure to comply with the federal regulations. Recommendation: Management should strengthen its procedures in calculating the days of attendance and the total days in an academic period to ensure that the calculations comply with the applicable federal regulations. In addition, management should identify and correct all excessive returns of Title IV funding made on students? behalf. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-104).

2021-037 - Weakness in Controls over Eligibility Requirements Award Year: 2021 Award Number: P268K211522 Compliance Requirement: Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: NSU did not have adequate controls in place to ensure that financial aid packages awarded to students remained within the appropriate limits set by federal regulations. Out of a non-statistical random sample of 40 students from a population of 6,504 students that were disbursed funds from the Federal Pell Grant Program and/or Federal Direct Student Loans for the Fall 2020, Spring 2021, or Summer 2021 semesters, one student (2.5%) received awarded financial aid that exceeded the student?s calculated gross financial need by $144. During discussions regarding this issue, NSU?s management represented to us that it reviewed multiple reports and identified an additional $95,709 of financial aid awards for the Fall 2020, Spring 2021, and Summer 2021 semesters that exceeded 91 students? calculated gross financial needs. Criteria: 34 CFR 685.200(a)(2)(i) states that a Direct Subsidized Loan Borrower must demonstrate financial need in accordance with Title IV, Part F of the Higher Education Act (20 USC 1087kk). 20 USC 1087kk states that, except as otherwise provided therein, the amount of need of any student for financial assistance under this subchapter is equal to (1) the cost of attendance of such student, minus (2) the expected family contribution for such student, minus (3) estimated financial assistance not received under this subchapter. 20 USC 1070a(b)(3) states that no Federal Pell Grant under this subpart shall exceed the difference between the expected family contribution for a student and the cost of attendance at the institution at which that student is in attendance. If, with respect to any student, it is determined that the amount of a Federal Pell Grant plus the amount of the expected family contribution for that student exceeds the cost of attendance for that year, the amount of the Federal Pell Grant shall be reduced until the combination of expected family contribution and the amount of the Federal Pell Grant does not exceed the cost of attendance at such institution. Cause: Management indicated that it discovered an error that prevented periodic reports, that are designed for use in correcting excess financial aid, from identifying all students with excess financial aid awards. Management represented that they had initiated corrective action to identify and correct the affected students, but that the error was not discovered until after fiscal year 2021 ended. Effect: Failure to detect and correct financial aid awards that exceed students? calculated gross financial need resulted in noncompliance with applicable federal regulations. Recommendation: Management should develop and implement controls that will either prevent or detect and correct situations in which students are awarded financial aid that exceed their calculated gross financial need. In addition, management should take corrective action to resolve all of the identified cases in which students have financial aid awards that exceed their calculated gross financial needs. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-105).

2021-038 - Failure to Return Title IV Funds in Required Time Frames Award Year: 2021 Award Numbers: P063P205745, P268K215745 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: South Louisiana Community College (SLCC) failed to return, to the USDOE within required time frames, SFA funds that SLCC attempted to disburse directly to a student or parent but the student or parent did not receive. Management has identified $30,347 of SFA funds that were not returned to the USDOE as required during the fiscal year ending June 30, 2021. Management is currently developing procedures to address this requirement and is working to identify and return funds to the USDOE as quickly as possible. Criteria: Per 34 CFR 668.164(l): (1) Notwithstanding any state law (such as a law that allows funds to escheat to the state), an institution must return to the secretary any Title IV, Higher Education Act program funds, except FWS program funds, that it attempts to disburse directly to a student or parent that are not received by the student or parent. For FWS program funds, the institution is required to return only the Federal portion of the payroll disbursement. (2) If an EFT to a student's or parent's financial account is rejected, or a check to a student or parent is returned, the institution may make additional attempts to disburse the funds, provided that those attempts are made not later than 45 days after the EFT was rejected or the check returned. In cases where the institution does not make another attempt, the funds must be returned to the secretary before the end of this 45-day period. (3) If a check sent to a student or parent is not returned to the institution but is not cashed, the institution must return the funds to the secretary no later than 240 days after the date it issued the check. Cause: Management represented there were no procedures to return these funds to the USDOE. Additionally, SLCC was unaware of the specific time frame to return the funds to the USDOE until recently when it started looking at Higher Education Emergency Relief Fund (HEERF) monies that were returned to SLCC from the financial institution. Effect: SLCC?s failure to have a process in place to timely return the funds to the USDOE results in noncompliance with federal regulations and could result in disallowed costs. Recommendation: Management should develop and implement a process to return all SFA funds that are not received by a student or parent to the USDOE within the required time frames set by federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-106).

2021-039 - Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security Award Year: 2021 Award Numbers: P063P205745, P268K215745 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SLCC did not have a formal documented risk assessment or related safeguards that address the following minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information: ? Employee training and management; ? Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing, and responding to attacks, intrusions, or other system failures. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program, (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards' key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: Management has represented that SLCC has procedures to provide employees and management with security training, to perform information system vulnerability scanning and network activity monitoring, and has policies on passwords and data disposal, but has not performed a formal documented risk assessment including safeguards to address the identified risks required by federal regulation. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information and results in noncompliance. Recommendation: Management should develop, implement, maintain, and document information security programs that include a formal documented risk assessment of relevant areas of operation, and design and implement safeguards to control the risks identified in regards to student information. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-107).

2021-040 - Noncompliance with Borrower Data Reconciliation Requirements Award Year: 2021 Award Number: P268K211524 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Southeastern Louisiana University (Southeastern) did not properly reconcile the School Account Statement (SAS) data files to the institution?s financial records on a monthly basis for the Federal Direct Student Loans program. Each month, the USDOE?s Common Origination and Disbursement (COD) system provides the institution the SAS data files, which should reconcile back to the G5 system Draw Down reports and the institution?s financial records to ensure the institution has transmitted accurate and complete student data to the COD system for all Federal Direct Student Loan borrowers in accordance with federal requirements. During fiscal year 2021, audit procedures revealed that eight of 12 monthly reconciliations were not completed timely and did not include documentation for unreconciled differences in student disbursements between the G5 system and the COD system. Criteria: 34 CFR 685.300(b)(5) requires that institutions must, on a monthly basis, reconcile institutional records with Federal Direct Student Loan funds received and disbursement records submitted to and accepted by the USDOE. Per the 2020-2021 Federal Student Financial Aid Handbook (Volume 4, Chapter 6), a school that participates in the Federal Direct Student Loan Program is required monthly to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the COD system. Cause: Southeastern did not have adequate controls in place to ensure adherence with federal regulations in its performance of monthly reconciliations of Federal Direct Student Loan receipts and disbursements. Effect: Failure to set prescribed controls to perform the SAS data file monthly reconciliation places Southeastern in noncompliance with federal regulations and could result in Southeastern reporting inaccurate information to the COD system. Recommendation: Management should strengthen its controls to ensure Southeastern properly performs monthly reconciliations of the G5 system to the COD system and properly documents the resolution of differences in the disbursement information between Southeastern and the COD system. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-108).

2021-041 - Control Weakness over and Noncompliance with Higher Education Emergency Relief Fund Reporting Requirements Award Year: 2021 Award Numbers: P425E200926, P425F201887, P425J200055 Compliance Requirement: Reporting Repeat Finding: Yes (Prior Year Finding No. 2020-032) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, Southern University Baton Rouge (SUBR) did not ensure compliance with certain reporting requirements as established by the USDOE for the HEERF provided by the Coronavirus Aid, Relief, and Economic Security (CARES) Act known as HEERF I and the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) known as HEERF II. Based on our procedures, the following errors in reporting were identified: ? In a non-statistical sample of two quarters from a population of four quarters, HEERF I Institutional and Historically Black Colleges and Universities amounts reported on the Quarterly Budget and Expenditure Reporting Form for quarters ending December 31, 2020, and June 30, 2021, were cumulative rather than quarterly totals, as instructed. ? HEERF II information reported for quarter ending June 30, 2021, which was the only required quarterly report for SUBR during the period under audit, did not include the total number of students that received Emergency Financial Aid Grants (Student Aid Portion). In addition, how much students would receive based on whether they were full-time, part-time, undergraduate, graduate, Pell recipient or non-Pell recipient was also not posted on the website. ? Annual report amounts for Emergency Financial Aid did not agree to supporting documentation for the following: the number of students eligible to receive grants, the number of grant recipients, the grant amounts disbursed and the average award per student in total and by category (full-time, part-time, undergraduate, graduate student, Pell recipient or non-Pell recipient). Criteria: Per the USDOE?s instructions on the Quarterly Budget and Expenditure Reporting Form, a new separate form must be posted on the institution?s primary website covering each quarterly reporting period. Per the May 13, 2021, Federal Register, institutions are required to report to the USDOE on their primary website certain information including: the total number of students who have received an Emergency Financial Aid Grant to students under the HEERF II and how much the students would receive. The CARES Act, Section 18004(e), and the CRRSAA, Section 314(e), require an institution receiving funds under HEERF I and HEERF II to submit a report to the USDOE, at such time in such a manner as the USDOE may require. Cause: SUBR did not have an effective review process in place to ensure it reported accurate information as required by federal regulations. Effect: Failure to establish a review process that will identify errors in quarterly and annual amounts reported for HEERF may result in noncompliance with federal regulations. Recommendation: Management should strengthen its procedures over the review of information reported for HEERF to ensure compliance with reporting requirements. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and outlined a plan of corrective action. Management did not concur that this was a repeat finding based on its interpretation of the criteria in the initial finding. Management also did not concur that it was noncompliant with the USDOE reporting requirements related to the Quarterly Budget and Expenditure Reporting Form based on information obtained from a webinar (B-110). Auditor?s Additional Comments: This finding is considered a repeat finding due to internal control weaknesses related to HEERF reporting requirements being reported for two consecutive audits. Also, the Quarterly Budget and Expenditure Reporting Forms were not completed in accordance with federal requirements.

2021-042 - Control Weakness over and Noncompliance with Return of Title IV Funds Award Year: 2021 Award Numbers: P063P201525, P268K211525 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-033) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, SUBR did not have adequate controls in place to ensure that returns of Student Financial Assistance Title IV funds were calculated and returned to the USDOE as required by federal regulations. In a non-statistical sample of 60 students for the Fall 2020 and Spring 2021 semesters, from a population of 491 students who were evaluated for return of funds, the following was noted: ? For 44 students (73%), SUBR did not return $99,302 of unearned Title IV funds to the USDOE within 45 days of determining the student?s withdrawal date as required by federal regulations. ? For 13 students (22%), some of which are reported above, SUBR inaccurately calculated the institution and/or students required return of Title IV funds due to the following: ? One student who never began attendance was improperly reported as an unofficial withdraw; therefore, all funds awarded to the student should be returned. ? Three students utilized the COVID-19 grading policy that allowed students to change grades to a ?W? at the end of the enrollment period. These students completed the enrollment period but were incorrectly identified as unofficial withdrawals. SUBR calculated a return for these students in error. ? For four students, SUBR did not include institutional charges in the return of Title IV calculation, which caused an error in the return calculations. ? For five students, the incorrect term dates in the Banner system caused an error in the return calculations. Audit procedures revealed that SUBR used incorrect academic calendar dates in the Banner system, which affected the total number of enrollment period days in the return of Title IV calculations. The number of days used in the fall semester was 152 days instead of 115 days, and the number of days used in the spring semester was 151 instead of 106 days. ? For one student included above, SUBR did not provide notice to the student or obtain confirmation from the student before issuing a post withdrawal disbursement, as required by federal regulations. Direct Loans were distributed to the student 221 days after the student withdrew Criteria: 34 CFR 688.22(a)(1) requires the institution to determine the amount of Title IV funds that the student earned as of the student?s withdrawal date. 34 CFR 668.22(e)(4) requires the institution to calculate the amount of unearned Title IV assistance to be returned. 34 CFR 668.22(j) requires the institution to return unearned Title IV funds within 45 days of the determination date of withdrawal. 34 CFR 668.21(a)(1) requires the institution to return all Title IV funds if a student does not begin attendance at the institution. 34 CFR 668.22(f) defines how the percentage of the period of enrollment completed is calculated, including the total number of days in the period of enrollment. Furthermore, the Student Financial Assistance Handbook states the instructional time in an academic year should begin on the first day of classes and end on the last day of classes or examinations. Per 34 CFR 688.22(a)(6)(iii)(A) and (C), for post withdrawal disbursements, a written notification must be provided to the student within 30 days of the date of the institution's determination that the student withdrew. The institution must disburse direct loan fund in the manner specified by the student, but no later than 180 days after the date of the institution's determination that the student withdrew. Per Section 3508 of the CARES Act, a return of Title IV funds to the USDOE was waived for student withdrawals related to a qualifying emergency. The USDOE?s electronic announcement dated May 15, 2020 (updated June 16, 2020), clarified that an institution cannot automatically apply CARES Act Return of Title IV Funds relief to all students who withdraw during a payment period or period of enrollment unless a disruption to instruction occurred during that period. Cause: SUBR granted waivers to all students with a required return of Title IV funds, although SUBR did not have an interruption to instruction during fiscal year 2021. Also, SUBR did not have adequate procedures in place to ensure an accurate calculation of unearned funds to be returned to the USDOE or that federal guidelines were followed when making a post withdrawal disbursement. Effect: Failure to return Title IV funds, prepare accurate calculations, and follow requirements related to post withdrawal disbursements results in noncompliance with federal requirements and increases the risk that federal funds will be required to be returned to the federal grantor. Audit procedures performed identified $99,302 that SUBR did not return to the USDOE, which are considered questioned costs. Recommendation: Management should strengthen controls to ensure that funds are returned timely to the USDOE, ensure that all return of Title IV funds calculations are performed accurately, and federal guidance for post withdrawal disbursements is followed. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-112).

2021-043 - Control Weakness over and Noncompliance with Student Financial Assistance Reporting Requirements Award Year: 2021 Award Number: P268K211525 Compliance Requirement: Reporting Repeat Finding: Yes (Prior Year Finding No. 2020-035) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, SUBR did not ensure compliance with SFA program regulations related to Direct Loan payment data reporting. In a non-statistical sample of 60 students from a population of 5,512 students who received SFA, audit procedures revealed that SUBR had the following Direct Loan exceptions for 43 (72%) students tested, of which some students had more than one error: ? For 43 students, the academic calendar dates reported to the Common Origination and Disbursement (COD) system did not agree with the first and last day of classes. ? For two students, the disbursement dates were inaccurately reported in the COD system. Criteria: Per the SFA Handbook, for Direct Loans, a loan period certified for an academic year includes academic calendar dates beginning on the first day of classes and ending on the last day of classes or examinations. 34 CFR 685.301(a) requires a school participating in the Direct Loan Program to ensure information it provides is complete and accurate including the borrower?s disbursement date and loan amount. Cause: SUBR did not implement adequate controls to ensure accurate academic calendar dates and disbursement dates were accurately reported to the COD system. Effect: Failure to record and report accurate origination and disbursement data to the COD system results in noncompliance with federal regulations and could affect a borrower?s loan eligibility. Recommendation: Management should strengthen its internal controls over SFA data recording and reporting as well as make appropriate corrections to dates reported in the COD system as needed. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-114).

2021-044 - Control Weaknesses over Higher Education Emergency Relief Fund Requirements Award Year: 2021 Award Numbers: P425E200926, P425F201887, P425J200055 Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR did not have adequate controls over financial grants to students for the HEERF as provided by the CARES Act known as HEERF I and the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) known as HEERF II. In addition, SUBR?s calculation of estimated lost revenue did not follow guidance provided by the USDOE. Based on our procedures, the following errors were identified: ? In a non-statistical sample of 60 students from a population of 5,510 students that received both HEERF I and HEERF II funds from HEERF Student Aid Portion, one student received $400 less HEERF II funds than the amount established per the SUBR distribution schedule. SUBR subsequently paid the amount owed. ? Due to the exception noted above, auditors reviewed all students who received HEERF I and HEERF II Student Aid Portion funds and found that 55 additional students who received HEERF II funds were under paid by a total of $21,000, and nine students who received HEERF II funds were overpaid by a total of $900. SUBR subsequently paid the 55 students the amounts owed. ? In a non-statistical sample of 60 students from a population of 1,366 students that received HEERF I Historically Black College and University (HBCU) funds, one student received $41 more than the outstanding balance amount approved on the Tuition Assistance Grant Request form, and another student received $2,500 with no Tuition Assistance Grant Request form, as required by SUBR. SUBR subsequently provided approved forms for both students that supported these amounts which the students were due. ? SUBR calculated lost revenue by comparing fiscal year 2020 to fiscal year 2021, which is inconsistent with guidance provided by the USDOE. When calculating lost revenue, a year prior to the March 13, 2020 national emergency declaration should be used as a baseline. Criteria: Per the CARES Act, Section 18004(c), institutions of higher education shall provide emergency financial aid grants to students for expenses related to the disruption of campus operations due to the coronavirus and per CRRSAA, Section 314(c)(3), institutions of higher education may use funds to provide financial aid grants to students which may be used for any component of the student?s cost of attendance or for emergency costs that arise due to coronavirus. Per the CARES Act 18004(d)(2), an HBCU may use awards under the Higher Education Act to prevent, prepare for, and respond to coronavirus. Per the CRRSAA, Section 314(c)(1), an institution of higher education may use HEERF to defray expenses associated with coronavirus (including lost revenue). SUBR established a plan to distribute HEERF I and HEERF II funds to students based on their Expected Family Contribution and whether they were full-time, part-time, undergraduate or graduate. For HEERF II funds, SUBR additionally determined whether the students were a Pell recipient or non-Pell recipient. For HBCU funds, students with an outstanding tuition and fees balance owed to the university were contacted by SUBR and invited to complete a Tuition Assistance Grant Request form with specific terms and conditions. Cause: SUBR did not have an effective review process to ensure that disbursements to students were in accordance with SUBR?s prescribed methodology. In addition, SUBR did not follow guidance provided by the USDOE for the calculation of lost revenues. Effect: Failure to adequately review HEERF funds provided to students resulted in students receiving the incorrect grant award. Failure to follow lost revenue guidance provided by the USDOE resulted in SUBR using a baseline year during the period of the national emergency declaration, which caused the amount of lost revenue calculated to be less than it would have been otherwise. Recommendation: Management should strengthen its review process over the disbursement of grants to students and recoup overpayments to students. SUBR should also revise its lost revenue calculation in accordance with federal guidance and draw any additional funds it is eligible to receive. Management?s Response and Corrective Action Plan: Management acknowledged the exceptions noted in the finding and provided a corrective action plan (B-115).

2021-045 - Inaccurate Reporting of Student Enrollment Status Award Year: 2021 Award Number: P268K211525 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-038) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, Southern University Law Center (SULC) did not ensure changes in enrollment status for students who received Federal Direct Student Loans were accurately and timely reported to the National Student Loan Data System (NSLDS) as required by federal regulations. In a non-statistical sample of 18 students tested for changes in enrollment status from a population of 174 students, 14 (78%) students had incorrect enrollment status information reported to NSLDS and the accurate status of graduated was reported more than four months late. Criteria: 34 CFR 685.309 requires, unless it expects to submit its next updated enrollment report to the USDOE within the next 60 days, a school must notify the USDOE within 30 days after the school discovers that a loan under the Title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended. Cause: SULC did not have proper controls in place to ensure changes in enrollment status for students who received Federal Direct Student Loans were accurate and timely reported to NSLDS. Effect: Inaccurate and untimely reporting of changes in enrollment status could impact the student?s loan eligibility and result in either the advance or delay of a student?s grace period or obligation to begin or resume making scheduled loan payments, which could impair the federal government?s ability to recoup loan funds from the student and results in noncompliance with federal regulations. Recommendation: Management should strengthen its procedures over changes in enrollment status for students receiving Federal Direct Student Loans and report accurate and timely information to NSLDS. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-117).

2021-046 - Control Weakness and Noncompliance over Disbursements to or on Behalf of Students Award Year: 2021 Award Number: P268K211529 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: UL Lafayette failed to inform students and/or parents receiving Federal Direct Loans of their right to cancel all or a portion of their loan disbursements and the procedures and time by which they must notify the institution that they wish to cancel the loan disbursement as required by federal regulations. In a non-statistical sample of 40 transactions from a population of 21,905 Federal Direct Loan disbursement transactions that were evaluated for disbursements to or on behalf of students, 11 (27.5%) students and/or parents did not receive automated e-mails notifying them of their rights to cancel all or a portion of their loan disbursements and the procedures and time by which they must notify the institution that they wish to cancel the loan disbursement. Criteria: 34 CFR 668.165(a)(2) requires that except in the case of a post-withdrawal disbursement made in accordance with 34 CFR 668.22(a)(5), if an institution credits a student ledger account with Direct Loan, Federal Perkins Loan, or TEACH Grant program funds, the institution must notify the student or parent of: (i) The anticipated date and amount of the disbursement; (ii) The student's or parent's right to cancel all or a portion of that loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Secretary; and (iii) The procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. Cause: UL Lafayette uses an automated process to send out e-mails containing the required information to students/parents receiving Federal Direct Loans. UL Lafayette submitted an IT ticket on August 7, 2020 to schedule the e-mails for the semester. The ticket was processed on August 10, 2020. The code to select the e-mail recipients looks for transaction dates within two days of the date that the job is being run; therefore, the job for disbursement emails run on August 11, 2020 excluded transaction dates prior to August 8, 2020. All of the students in our sample with exceptions had a disbursement date of August 7, 2020, which was the first disbursement date of the semester. Therefore, these students were not selected to receive the automated e-mail. Effect: Failure to inform students and/or parents of their right to cancel all or a portion of their Federal Direct Loans results in noncompliance with federal regulations and could have an impact on students and/or parents decision making. Recommendation: Management should strengthen controls to ensure that all borrowers of Federal Direct Loans receive the required information. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-119).

2021-047 - Control Weakness and Noncompliance over Return of Title IV Funds Award Year: 2021 Award Numbers: P063P201529, P268K211529 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-041) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, UL Lafayette did not have adequate controls in place to ensure that return of Title IV funds was accurately calculated as required by federal regulations. In a non-statistical sample of 25 students from a population of 564 students who were evaluated for return of funds, three (12%) students had an incorrect withdrawal date used in the calculation for return of Title IV funds. The incorrect dates caused UL Lafayette to incorrectly calculate the percentage of the payment period completed. No funds were due to the USDOE as a result of the inaccurate calculation because the students completed over 60% of the payment period. Criteria: 34 CFR 668.22 requires the university to determine the amount of Title IV funds that the student earned as of the student?s withdrawal date. Cause: UL Lafayette did not have adequate procedures in place to identify the correct withdrawal date for all students. Effect: An inaccurate return of funds calculation could cause UL Lafayette to fail to identify funds that should be returned to the USDOE as required by federal regulations. Recommendation: Management should strengthen controls to ensure that all return of funds calculations are performed accurately and in compliance with federal regulations. Additionally, management should identify students with incorrect withdrawal dates, and if applicable, recalculate the return of Title IV amounts and return any additional funds to the USDOE. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-120).

2021-048 - Control Weakness over and Noncompliance with Higher Education Emergency Relief Fund Reporting Requirements Award Years: 2020, 2021 Award Numbers: P425E200778, P425F200601 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: UL Lafayette did not adequately implement controls to ensure compliance with certain reporting requirements as established by the USDOE for the HEERF provided by the Coronavirus Aid, Relief, and Economic Security (CARES) Act known as HEERF I. In a non-statistical sample of two quarters ending September 30, 2020, and December 31, 2020, from a population of four quarters during the fiscal year 2021, the following exceptions were noted: ? HEERF I Institutional Portion amounts reported on the Quarterly Budget and Expenditure Reporting Form for the quarter ending December 31, 2020, were cumulative rather than quarterly totals, as instructed by the USDOE. In addition, UL Lafayette was unable to provide evidence that the information in the two quarterly reports for quarters ending September 30, 2020, and December 31, 2020, were reviewed and approved prior to posting. ? UL Lafayette was unable to provide evidence that the information in the HEERF I Student reports for quarters ending September 30, 2020, and December 31, 2020, were reviewed and approved prior to posting. In addition, UL Lafayette was not able to provide evidence that the annual report which was due February 8, 2021, was reviewed and approved prior to submission. Criteria: The USDOE required Annual Reporting for HEERF I funds to be submitted on the Data Collection Form by February 8, 2021 which applied to the reporting period from March 13, 2020, through December 31, 2020. The USDOE required separate Quarterly Public Reporting for the Institutional Portion and Student Aid Portion. Per the USDOE?s instructions on the Quarterly Budget and Expenditure Reporting under the CARES Act for the Institutional Portion, a new separate form must be posted on the institution?s primary website covering each quarterly reporting period. Cause: UL Lafayette could not provide evidence that the review process in place was implemented to ensure it reported accurate information as required by federal regulations. Effect: Failure to implement a review process that will identify errors in quarterly and annual amounts reported for HEERF resulted in noncompliance with federal regulations. The error overstated HEERF I Institutional Portion December 31, 2020 quarter expenditures by approximately $6.9 million. Recommendation: Management should revise any reports incorrectly posted with cumulative totals to reflect actual activity for that quarter. Additionally, management should implement its procedures over the review of information reported for HEERF to ensure accuracy of information reported and compliance with reporting requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-122).

2021-049 - Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security Award Year: 2021 Award Numbers: P063P201529, P268K211529 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-042) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, UL Lafayette did not have a formal documented risk assessment or related safeguards that address the following minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information within the 2020-2021 award year: ? Employee training and management; ? Information systems including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing and responding to attacks, intrusions, or other systems failures. UL Lafayette has information technology policies and practices that require employee training, information technology security policies and procedures, a documented disaster recovery plan, and password policy, but has not performed a formal documented risk assessment including safeguards to address identified risk as required by federal regulations. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program, (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards? key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: UL Lafayette did not perform a formal documented risk assessment including safeguards to address the identified risks within the 2020-2021 award year. The risk assessment document UL provided was performed between August 4 and August 6, 2021, which is outside of our audit period. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information and results in noncompliance with federal regulations. Recommendation: Management should develop, implement, and maintain information security programs that include a formal documented risk assessment of relevant areas of operation. Also, management should document the design and implementation of safeguards to control the risks identified in regards to student information within the required fiscal period. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a corrective action plan (B-123).

2021-050 - Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security Award Year: 2021 Award Numbers: P063P201521, P268K211521 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-043) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, the University of Louisiana at Monroe (ULM) was not in compliance with the requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information. While ULM had a formal documented risk assessment and safeguards to address each risk documented, the safeguards have not been fully implemented during fiscal year 2021 to address the identified risks relating to: ? Employee training and management; ? Information systems including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing, and responding to attacks, intrusions, or other system failures. Criteria: 16 CFR 314 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program, (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards? key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: ULM contracted with an outside firm to have the formal risk assessment performed; however, the risk assessment was not provided to ULM until June 2021, and therefore, ULM was unable to implement safeguards to address identified risks. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information and results in noncompliance. Recommendation: Management should continue to implement safeguards to control the risks identified. Management should also continue on-going risk assessments and implement safeguards to address any additional risks identified. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-125).

2021-051 - Noncompliance with Borrower Data Reconciliation Requirements Award Year: 2021 Award Numbers: P268K191519, P268K201519, P268K211519 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-044) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive audit, the University of New Orleans (UNO) management did not ensure that monthly reconciliations of the School Account Statement (SAS) data files to the institution?s financial records were performed as required by federal regulations. Each month, the USDOE?s Common Origination and Disbursement (COD) system provides the institution the SAS data file, which should reconcile to the institution?s financial records to ensure the institution has transmitted accurate and complete data to the COD system for all Federal Direct Student Loan borrowers in accordance with federal requirements. For the three months selected for review, UNO did not provide evidence to show that the cash summary information on the SAS was reconciled to its financial records. UNO did provide evidence to show that its monthly disbursements and adjustments were reconciled to the SAS; however, there was no evidence to show when the reconciliations were prepared. As a result, we could not determine if the reconciliations were prepared on a monthly basis as required. Criteria: 34 CFR 685.300(b)(5) requires that schools must, on a monthly basis, reconcile institutional records with Direct Loan funds received and Direct Loan disbursement records submitted to and accepted by the USDOE. Cause: UNO?s written procedures did not include adequate details to ensure that all of the required reconciliations were performed on a monthly basis and that adequate supporting documentation was maintained. Effect: Failure to perform the monthly reconciliations could result in undetected discrepancies between the institution?s financial records and data in the COD system. Recommendation: Management should modify its written procedures for completing the monthly reconciliations to include all required components of the reconciliation and to provide specific guidance on the supporting documentation to be maintained as evidence that the reconciliations were performed on a monthly basis. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a plan of corrective action (B-126).

2021-052 - Control Weakness over Social Services Block Grant Activities Allowed or Unallowed and Reporting Requirements Award Year: 2021 Award Number: 2101LASOSR Compliance Requirements: Activities Allowed or Unallowed, Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Children and Family Services (DCFS) did not have a process in place to ensure $16 million of Temporary Assistance for Needy Families (TANF) grant funds transferred to the Social Services Block Grant (SSBG) were only used for programs or services for children or their families whose income is less than 200% of the poverty level. While DCFS was unable to initially provide support that showed TANF funds transferred to SSBG were used only for services to clients who met the income threshold, it subsequently gathered data and developed a methodology to substantiate the federal expenditures. In addition, the SSBG Post Expenditure Report included all individuals who received services through other federal programs which can be supported with SSBG funds rather than only those individuals who actually received services paid for in whole or in part with SSBG funds, as required. Criteria: Per 42 USC 604(d)(3)(B), all TANF amounts paid to a state that are used to carry out state programs under SSBG shall be used only for programs and services to children or their families whose income is less than 200% of the income official poverty line. Per 2 CFR 200.302(a), each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Per 42 USC 1397e(c)(1), the SSBG Post Expenditure Report shall present the number of individuals who received services paid for in whole or in part with SSBG funds, showing separately the number of children and the number of adults who received such services, and broken down in each case to reflect the types of services and circumstances involved. Cause: DCFS utilized the TANF transfer funds based on its knowledge that the majority of the populations served meet the income requirement and did not have a tracking process to identify individuals served by SSBG for reporting purposes. Effect: Failure to implement proper controls over the accounting for SSBG expenditures could result in noncompliance with federal regulations, increases the likelihood of disallowed costs that may have to be returned to the federal grantor, and affects required reporting. Recommendation: DCFS should maintain controls to ensure expenditures related to TANF funds transferred to SSBG are used for services related to children and families that meet the income requirements and establish procedures to properly prepare the SSBG Post Expenditure Report. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-6).

2021-053 - Misappropriated Funds in the Child Care Assistance Program Award Year: 2020 Award Number: 2001LACCC3 Compliance Requirement: Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: DOE launched an investigation on March 29, 2021, when personnel became aware that an employee manipulated data in the grant tracking and payment systems for the Child Care Assistance Program (CCAP). DOE received Coronavirus Aid, Relief, and Economic Security (CARES) Act funds through the Child Care and Development Block Grant. These funds were distributed as grants to CCAP child care providers to support child care access during the pandemic. A former DOE Provider Certification supervisor is accused of manipulating provider information and submitting and receiving payment for four alleged fraudulent grant applications. In April 2021, DOE reported the misappropriation to the U.S. Department of Health and Human Services? (HHS) Administration for Children and Families and Office of Inspector General, the legislative auditor, East Baton Rouge parish district attorney, and Louisiana State Police. The employee was immediately suspended, was terminated in April 2021, and was arrested in June 2021 on charges including theft, computer fraud, bank fraud, money laundering, filing or maintaining false public records, and malfeasance in office. DOE repaid the $74,250 in misappropriated funds to HHS in July 2021. Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain internal control over the federal award that provides reasonable compliance with federal statutes, regulations, and the terms and conditions of the federal award. Cause: The misappropriation of funds occurred because DOE did not have adequate controls in place to prevent the employee from manipulating data used to process provider payments and from changing provider banking information in the payment system. Effect: As a result of the investigation, DOE identified $74,250 in alleged fraudulent payments. Recommendation: DOE should strengthen internal controls to ensure that duties are properly segregated to prevent employees who certify and set up providers from changing provider banking information in the payment system and from making changes to documents used to process payments. In addition, DOE should review all changes to provider information to ensure that the changes are appropriate. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a plan of corrective action (B-13).

2021-054 - Inadequate Controls over and Noncompliance with National Correct Coding Initiative Requirements Award Years: 2020, 2021 Award Numbers: 2005LA5MAP, 2105LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH failed to properly implement and monitor National Correct Coding Initiative (NCCI) Requirements for Medically Unlikely Edits (MUE) and Procedure-to-Procedure (PTP) edits for the Medical Assistance Program (Medicaid) Fee-for-Service (FFS) claims. MUE is an edit on claims in which the number of units billed on the claim are more than what is considered necessary/allowed for a particular procedure code and PTP is an edit on claims in which one specific procedure code is not allowed to be billed with a different specific procedure code on the same recipient on the same day by the same provider. Our testing of NCCI edits included all FFS claims for Durable Medical Equipment (DME), Outpatient Hospital Service (OP), and practitioner and ambulatory surgical center (PRA) paid in state fiscal year 2021. These claims were subject to two edit types: MUE and PTP. In a test of 11,744,241 paid claims to determine if the proper NCCI MUE and PTP edits had been implemented, the following was noted: ? 21,022 claims for DME, OP, and PRA were paid but should have been evaluated by an NCCI MUE and denied. These NCCI MUE edit errors resulted in questioned costs of $818,620 ($602,372 federal funds and $216,248 state funds). LDH noted that required NCCI MUE edits have not been applied to OP and DME FFS claims due to system constraints. ? 173 claims for DME, OP, and PRA were paid but should have been evaluated by an NCCI PTP edit and denied. These NCCI PTP edit errors resulted in questioned costs of $4,582 ($3,394 federal funds and $1,188 state funds). Criteria: Section 1903(r) of the Social Security Act requires State Medicaid agencies to incorporate NCCI methodologies into the State Medicaid programs. The NCCI Medicaid Technical Guidance Manual contains requirements for implementation of the NCCI methodologies. Cause: The errors noted occurred due to inadequate NCCI edit monitoring procedures by LDH and instances of noncompliance with the federal regulations and guidance manuals. Effect: Failure to properly implement and enforce all required NCCI edits increases the likelihood that FFS claims, which should be denied, could potentially be paid. Recommendation: Management should ensure all required NCCI edits are properly applied to FFS claims. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-25). Auditor?s Additional Comments: Management?s response stated, ?The data pull does not consider historical claims or the final adjudication.? However, LLA data analysis included historical claims and final adjudication for FFS claims paid in state fiscal year 2021.

2021-055 - Inadequate Controls over Billing for Behavioral Health Services Award Years: 2020, 2021 Award Numbers: 2005LA5021, 2005LA5MAP, 2105LA5021, 2105LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2020-046) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, LDH, the managed care organizations (MCOs), and Magellan Health Services (Magellan) did not have adequate controls in place to ensure that behavioral health services in the Medical Assistance Program (Medicaid) and Children?s Health Insurance Program (CHIP) were properly billed and that improper encounters were denied. For fiscal year 2021, we identified approximately $8.4 million in encounters for services between July 1, 2020, and June 30, 2021, that were paid by the MCOs and Magellan even though the encounters do not appear to comply with LDH?s encounter coding requirements and/or approved fee schedules. Our analysis identified the following instances of billing errors: ? Providers were paid $6,946,683 for 113,224 encounters that were billed using incorrect procedure and modifier codes. ? Providers were paid $1,462,493 more than indicated on approved fee schedules for 26,707 encounters for behavioral health services; the MCOs confirmed that they did not have alternative fee schedules. Criteria: LDH?s fee schedule outlines procedure codes for services and the applicable billing rates. Some services require that procedure codes also contain modifier codes which indicate information such as the age of the recipient, location where the service was provided, the educational background of the person providing the service, and the license(s) they have obtained. The approved fee schedules outline different rates depending on the procedure code and modifier codes. The MCOs can optionally pay more than the minimum LDH fee schedule. Cause: The billing errors could be avoided by LDH, the MCOs, and Magellan applying system edits that would flag encounters for further review when encounter coding and/or fee schedule requirements are not followed. Effect: Without the required modifiers, the encounter does not contain enough information to determine that the billing was appropriate. Because LDH does not currently maintain a list of providers in which the MCO pays more than the minimum fee schedule, LDH cannot determine if an encounter paid at an excessive rate was improperly billed It is important that encounter data is accurate because LDH and other stakeholders, such as the Medicaid Fraud Control Unit within the Attorney General?s Office, use this data to identify improper payments and potential fraud. LDH also uses this encounter data to establish per member per month rates for the MCOs. Recommendation: LDH management should implement adequate internal controls to ensure that encounters are coded correctly, which could include edit checks to flag potential improper billings for further review. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-30).

2021-056 - Inadequate Controls over Drug Rebate Collections Award Years: 2020, 2021 Award Numbers: 2005LA5MAP, 2105LA5MAP Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH contracted with Magellan Medicaid Administration, Inc. (Magellan) for support in performing the federal and supplemental drug rebates processing for the Medicaid program, including but not limited to invoicing, reconciliation, dispute resolution, and follow up on drug manufacturer (manufacturer) non-payment and aged balances for all of LDH?s Medicaid drug rebate programs. The contract sets a frequency in which a written delinquency notice (dunning notice) should be sent to manufacturers with unpaid invoices, but does not address manufacturers who make partial payments towards their quarterly invoice. Magellan personnel confirmed that these dunning notices are only sent to manufacturers who have not made any payments towards an invoice. For instance, and as described by Magellan, Magellan would not send a dunning notice to a manufacturer who submits a partial payment of even a penny. In a non-statistical sample of 60 drug rebate invoices from a population of 8,796, three tested (5%) revealed only a partial payment had been collected and no disputes had been made by the manufacturer. Magellan personnel also confirmed that a dunning notice was not sent to these manufacturers for the unpaid balances. Criteria: 42 USC 1396r-8 requires manufacturers that wish to have their covered outpatient drugs covered by Medicaid to enter into an agreement under which the manufacturers agree to pay rebates for drugs dispensed and paid for by state Medicaid agencies under the state plan. Those rebates are shared between the state and federal government. Drug rebates are to be paid by the drug manufacturers no later than 30 days after the date of receipt of the utilization data from the state or provide notice of disputed items not paid because of discrepancies found. The state should perform follow up procedures to attempt to collect any unpaid balances in a timely manner. Cause: LDH did not have adequate controls in place to monitor its contract with Magellan and was unable to identify a control that would address the timely collection of partially paid drug rebates invoices. Effect: Without procedures to address manufacturers that do not pay the entire quarterly balance, there is a risk that appropriate rebates will not be collected. Recommendation: LDH should ensure that agency personnel are adequately monitoring contract provisions for the drug rebate program and follow-up procedures are performed for all drug rebate invoices that have not been fully collected or disputed in a timely manner. This may include LDH amending the contract with Magellan to address those manufacturers who only make partial payments towards their invoice balance. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-31).

2021-057 - Inadequate Controls over Monitoring of Abortion Claims Award Years: 2020, 2021 Award Numbers: 2005LA5021, 2005LA5MAP, 2105LA5021, 2105LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2020-048) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, LDH did not have adequate controls to ensure compliance with federal regulations prohibiting the use of federal funding for abortion claims. Criteria: 42 CFR 441, Subpart E, and 42 USC 1397ee(c) prohibit Medicaid and CHIP funding for abortion services except in instances where an abortion is necessary to save the mother?s life or if the pregnancy is the result of an act of rape or incest. Under managed care, LDH pays the managed care health plans monthly premiums for enrolled recipients. The health plans pay provider claims for services provided to enrolled recipients and submit the claims to LDH as encounter claims. Cause: LDH included provisions in the Healthy Louisiana managed care contracts requiring the health plans to comply with the federal regulations regarding funding of prohibited abortion services, but LDH did not have adequate procedures in place to monitor the health plans? compliance with the federal regulations. While LDH received monthly self-reported information from the health plans, management confirmed that the reported information was not being compared to encounter data or validated in any other way to ensure the reporting was accurate and complete. In addition, the instructions provided to the health plans concerning how to complete the reports are not detailed and could potentially lead to all five health plans reporting different information. Effect: Claims paid by the managed care health plans for abortion services that do not meet exceptions noted in federal regulations may go undetected and LDH may accept these improper claims as encounter claims. Encounters are considered in future premium rate setting and are used for reporting and monitoring of the Medicaid and CHIP programs. Recommendation: LDH should develop procedures to validate self-reported information from the health plans to ensure compliance with federal regulations regarding funding of prohibited abortions claims. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-33).

2021-058 - Inadequate Controls over Service Providers with Closed Enrollment Award Years: 2020, 2021 Award Numbers: 2005LA5021, 2005LA5MAP, 2105LA5021, 2105LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-049) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LDH paid claims totaling $6,833 ($5,032 in federal funds and $1,801 in state funds) in state fiscal year 2021 with service dates occurring after the service providers were no longer enrolled in Medicaid and CHIP. In an analysis of 23,611 service providers with claims activity during fiscal year 2021, we noted 184 providers with enrollment end dates during the fiscal year or prior. Of the 184 providers, we noted 21 providers with claims paid for service dates after the providers? enrollment end date. After reviewing this analysis and information with LDH, errors were noted for eight providers as detailed below. ? Five providers with Medicare crossover claims totaling $4,990 in which LDH did not ensure the service providers were enrolled in Medicaid on the service dates being billed. Even if a provider is enrolled with the Centers for Medicare and Medicaid Services as a Medicare provider, the provider must be enrolled as a Medicaid provider to perform and be paid for services in the Medicaid programs. ? One provider with claims paid totaling $1,076 in which the enrollment end date was applied retroactively by LDH; however, LDH had already paid claims for service dates that were after the applied enrollment end date. ? One provider with claims totaling $767 in which the provider?s license had expired. The provider was given the following month to send in its renewal application, during which time the provider was allowed to continue to submit claims for payment. The provider did not renew its license within the allotted time frame; therefore, the original expiration date should have been the end enrollment date. ? One provider had a change of address, which generated a new license number. This process resulted in the provider being incorrectly disenrolled. While the provider did have claims paid for service dates after the erroneous end enrollment date, the claims are not considered improper due to the error by LDH. This error could have been identified if LDH had a review process. Criteria: LDH enrolls fee-for-service providers into the Medicaid and CHIP programs which includes entering into provider agreements as required by 42 CFR 431. Provider enrollment can end for various reasons, such as inactivity for a prolonged period, state or federal exclusion, license issues, or the provider elects to terminate enrollment. Cause: LDH lacked adequate procedures to ensure claims are only paid for service dates in which the service provider is enrolled. Effect: Payments made for services provided on dates that service providers are not enrolled in the program increases the risk that payments were made to providers that should not be providing services to Medicaid and CHIP recipients. Recommendation: LDH should ensure provider enrollment end dates are entered accurately and should develop and implement procedures to ensure claims are only paid for dates of service during time periods in which the provider was enrolled in the program. In cases of retroactive closures, LDH should develop and implement procedures to consider and address, as necessary, any claims already paid during that retroactive closure period. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-37).

2021-059 - Inadequate Controls over Waiver and Support Coordination Service Providers Award Years: 2020, 2021 Award Numbers: 2005LA5MAP, 2105LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2020-050) See Schedule of Findings and Questioned Costs for chart/table Condition: For the tenth consecutive year, LDH paid Medicaid Home and Community Based Services (HCBS) claims for the New Opportunities Waiver (NOW) for waiver services that were not documented in accordance with established policies. In addition, for state fiscal year 2021, LDH also paid claims for support coordination services that were not documented in accordance with established policies. These errors resulted in questioned costs of $28,896 ($21,243 federal funds and $7,653 state funds). Our testing of waiver services included 670 claims paid in state fiscal year 2021 totaling $115,245 paid to two providers for 11 recipients. The recipients received services from one waiver type, NOW. Our test identified errors for 166 claims totaling $28,431; some claims having multiple errors. The following errors were noted: ? For six claims for three recipients, the waiver services provider did not provide documentation to support consistent deviations from the approved plan of care (POC). ? For 109 claims for ten recipients, the waiver services provider did not provide adequate documentation to support billed services. ? For 60 claims for one recipient, the waiver services provider did not have an adequate POC present in the case records; therefore, we were unable to determine if a deviation from the POC occurred. In addition to testing waiver services, we also tested claims paid for support coordination services for the 11 waiver recipients tested. In our test of 130 claims paid in state fiscal year 2021 totaling $20,036 paid to four support coordination providers for the 11 recipients, the following was noted: ?For three claims for two recipients, the support coordination service provider did not provide adequate documentation to support billed services. These claims totaled $465. Criteria: NOW is administered by the Louisiana Department of Health, Office for Citizens with Developmental Disabilities (OCDD). Waiver services are accessed through support coordinators who assist with development and monitoring of the recipient?s POC. LDH HCBS waivers implemented electronic visit verification (EVV) in fiscal year 2019. EVV is a web-based system that electronically records and documents the precise date, start time, and end times that services are provided to recipients. Time documented through EVV should be the time billed to Medicaid for services. Providers are required to maintain certain other supporting documentation to support all time billed. Auditors used LDH?s provider manuals to identify required documentation. Provider manuals are intended to give a provider the information needed to fulfill its vendor agreement with the state of Louisiana, and is the basis for federal and state reviews of the program. The recipients case record is required to include a copy of the approved POC, including any revisions. The POC documents the recipient?s assessed needs and types and quantity of services to address those needs and costs related to services. Direct service providers provide care to a recipient based on the approved POC. According to the NOW provider manual, an occasional or temporary deviation from a recipient?s scheduled services is acceptable as long as the services altered are recipient-driven, person-centered, and occur within the prior authorization. According to the LDH service coordination provider manual, service logs are the means for clearly documenting services billed and must be reviewed by supervisors. Cause: The errors noted in testing occurred because LDH failed to ensure that NOW waiver and support coordination providers follow LDH policies related to proper record keeping and supporting documentation. Effect: Without adequate documentation a provider cannot substantiate and auditors cannot verify that the deviations were recipient-driven and person-centered as required. Without adequate supporting documentation and compliance with LDH established policies there is reduced assurance that billed services were actually performed, recipients are receiving needed services, and limited resources are allocated appropriately. Recommendation: LDH should ensure all departmental policies for waiver and support coordination services are enforced, including documentation to support claims and evidence that deviations from the approved POC meet the needs of the recipient. LDH should consider additional provider training regarding documentation requirements. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-40). Auditor?s Additional Comments: Management noted that OCDD sent documentation to the LLA but the finding does not reflect the information. During one provider?s site visit, incomplete supporting documentation was provided by the provider. After the auditor questioned the supporting documentation, the provider provided documentation that appeared to have been altered. As a result, LLA did not accept this documentation or other documentation from this provider. During other site visits, supporting documentation could not be provided for selected test items, with one provider informing us that the documentation was never completed/submitted by the provider?s staff prior to termination of employment. Providers are required to maintain supporting documentation and make such documentation available to the auditor in a reasonable time.

2021-060 - Inadequate Internal Controls over Eligibility Determinations Award Years: 2020, 2021 Award Numbers: 2005LA5021, 2105LA5021, 2005LA5MAP, 2105LA5MAP Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2020-051) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LDH lacked adequate internal controls over eligibility determinations in the Medicaid and CHIP programs for the fiscal year ending June 30, 2021. From a population of 1,946,600 recipients, a non-statistical sample of 60 Medicaid and 60 CHIP recipients were tested. Three (5%) out of 60 Medicaid recipients and four (7%) out of 60 CHIP recipients tested did not have adequate documentation to support the eligibility determination within the recipient?s case record. The following errors were noted for Medicaid: ? For one recipient, the case record did not contain information to support closure and reenrollment of the recipient. ? For two recipients, renewals were not performed during the state fiscal year as required by federal regulations. During our testing of managed care premiums, we identified an additional recipient with eligibility not supported by the case record. The recipient?s case record did not reflect timely transition into an appropriate case type based on the recipient?s age. Under the public health emergency (PHE), LDH had to continue eligibility determinations and renewals, but could only remove recipients in very limited circumstances. We did not note any questioned costs related to the above errors due to certain restrictions on eligibility actions during the PHE. The following errors were noted for CHIP: ? For two recipients, the case records do not reflect timely transition from the CHIP program after the recipients turned 19 years old. ? For two recipients, renewals were not performed during the state fiscal year as required by federal regulations. We noted questioned costs totaling $3,246 ($2,716 federal funds and $530 state funds) in relation to the two recipients not timely transitioned from CHIP. Under the PHE, there were no restrictions on transitioning recipients between programs with equal or greater benefits. We did not note any additional questioned costs related to other errors due to certain restrictions on eligibility actions during the PHE. Criteria: 42 CFR 431, 42 CFR 435, and 42 CFR 457 require that in order to be considered eligible, a recipient must meet all eligibility factors and the recipient case record must include facts to support agency eligibility decision. 42 CFR 435 and 42 CFR 457 also require annual renewal of eligibility. LDH has outlined eligibility criteria and documentation to support determinations and renewals in its Medicaid eligibility manual. Cause: LDH did not adhere to established control procedures to ensure case records support eligibility decisions, including performance of annual renewals, per the federal regulations and the Medicaid Eligibility Manual. Effect: Proper eligibility determination and renewals are critical to ensuring appropriate service eligibility, appropriate premium payments, and appropriate federal match rate on expenditures. Recommendation: LDH should ensure its employees follow procedures relating to eligibility determinations and renewals in the Medicaid and CHIP programs to ensure the case records support the eligibility decisions. Management?s Response and Corrective Action Plan: Management did not concur with the finding and noted that the Centers for Medicare and Medicaid Services (CMS) provided certain flexibilities in meeting the timeliness of renewals in accordance with 42 CFR 435.912(e)(2) and LDH used these flexibilities to suspend renewals during the PHE. LDH also indicated, while there was no particular documentation in the ?case note? section of the Louisiana Medicaid Eligibility Determination System (LaMEDS), LDH provided audit staff with LaMEDS log tables which indicated the renewals were set to a future date. In addition, LDH made the decision to stop processing the jobs for those aging out of current coverage groups (i.e., turning age 19 and transitioning out of child related programs) to mitigate the possibility of cases inappropriately closing or transitioning beneficiaries to groups with lesser benefits. Management decided to not process these transitions until the beneficiary?s next scheduled renewal (B-43). Auditor?s Additional Comments: The LaMEDS log tables were considered by the auditor. For one exception, the renewal date was set at 7/31/2019, and there was no evidence of any systems being checked within the data logs provided by LDH during state fiscal year 2021. For the remaining three exceptions, the renewal date was set to 12/31/2099, and there was no evidence of any systems being checked within the data logs provided by LDH during state fiscal year 2021. We believe that setting an indefinite date of 12/31/2099 ultimately suspended renewals. Although CMS granted flexibilities for completing the renewals at a future date, it did not appear that CMS was granting approval for suspension of renewals. CMS also notified LDH that federal regulation requires the agency to document the reason for the delay in each case record; LDH agreed that there was no particular documentation regarding suspensions in the case notes. We considered the log tables which indicated the renewals were set to a future date, but we do not believe that the indefinite date of 12/31/2099 alone sufficiently documents the reason for the delay in the case record as required by 42 CFR 435.912(f). For the errors related to case transitions, the transitions were not performed until the next scheduled renewal, which is not considered timely in accordance with LDH?s Medicaid Eligibility Manual and federal regulations. Under the PHE, there were no restrictions on transitioning these recipients between programs. Therefore, we do not believe the requirement was met.

2021-061 - Noncompliance with Managed Care Provider Enrollment and Screening Requirement Award Years: 2020, 2021 Award Numbers: 2005LA5021, 2005LA5MAP, 2105LA5021, 2105LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-052) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fourth consecutive year, LDH did not enroll and screen Healthy Louisiana managed care providers and dental managed care providers as required by federal regulations. Currently, the managed care plans continue to enroll and screen all managed care providers, in violation of federal regulations. Criteria: 42 CFR 438.602 (2016 Managed Care Final Rule) and Section 5005 of the 21st Century Cures Act require that the enrollment process include providing the Medicaid agency with the provider?s identifying information including the name, specialty, date of birth, Social Security number, national provider identifier, federal taxpayer identification number, and state license or certification number of the provider. Additionally, the state agency is required to screen enrolled providers, require certain disclosures, provide enhanced oversight of certain providers, and comply with reporting of adverse provider actions and provider terminations. By using the federally required process, managed care providers must participate in the same screening and enrollment process as Medicaid and CHIP fee-for-service providers. LDH was required to enroll and screen all Healthy Louisiana managed care providers by January 2018 and dental managed care providers by July 2018. Cause: LDH noted that enrollment and screening of managed care providers was to be performed as part of a new provider management system. After cancellation of the new provider management system contract, the state?s current provider enrollment vendor, Gainwell Technologies Inc., began the process of creating a web-based portal for Medicaid and its providers to complete the necessary screenings required by federal regulations; however, the portal was not operational during fiscal year 2021. Effect: LDH cannot ensure the accuracy of provider information obtained from the Louisiana Medicaid managed care plans and cannot ensure compliance with enrollment requirements defined by law and the Medicaid and CHIP state plan. LDH accepted 89.9 million Healthy Louisiana encounter claims totaling $6.6 billion and 3.1 million dental encounter claims totaling $116.3 million in fiscal year 2021 from the managed care plans and paid $9.7 billion in Healthy Louisiana premiums and $289.6 million in dental premiums. Recommendation: LDH should ensure all providers are screened, enrolled, and monitored as required by federal regulations. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-46).

2021-062 - Noncompliance with Prenatal Service Third-Party Liability Requirements Award Years: 2020, 2021 Award Numbers: 2005LA5021, 2005LA5MAP, 2105LA5021, 2105LA5MAP Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: Yes (Prior Year Finding No. 2020-053) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, LDH failed to implement controls to ensure compliance with third-party liability requirements for prenatal and pregnancy related services. Criteria: 42 CFR 433 requires that the Medicaid and CHIP programs are the payers of last resort. In most cases, federal law requires states to apply cost avoidance measures to claims by which all other payers are identified and payments from those identified payers are applied to the claim first. Federal funds would then be used for the remaining balance as applicable. Previously, regulations considered prenatal and pregnancy related services an exception to the cost avoidance requirement and required states to pay prenatal and pregnancy related claims without regard to any other liable third party. States could seek to recover payments from another liable third party at a later date through a process known as ?pay and chase?. The Bipartisan Budget Act of 2018 (Public Law 115-123) revised the Social Security Act, the authorizing legislation for Medicaid and CHIP programs, to eliminate the cost avoidance exception for prenatal services and pregnancy related services effective in February 2018. Cause: The Medicaid Eligibility manual was updated in June 2021, the General Information and Administration Provider manual were updated in April 2021, and the MCO contracts were updated effective January 2021 to reflect the revised requirement. LDH also issued a Health Plan Advisory in April 2021 directing the health plans to make required system changes to comply with the revised requirement. While LDH updated manuals, policies, and contracts, LDH did not implement controls to monitor managed care plan compliance with the revised regulation. Effect: The managed care health plans may have paid for services that should have been cost avoided. Managed care claims payments are sent to LDH as encounters which are used by LDH?s actuary for future rate setting. Recommendation: LDH should ensure that the Medicaid and CHIP programs are the payers of last resort by ensuring that cost avoidance measures are applied by the managed care health plans for prenatal services and pregnancy related services as required by federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-48).

2021-063 - Noncompliance with Provider Revalidation and Screening Requirements Award Years: 2020, 2021 Award Numbers: 2005LA5021, 2005LA5MAP, 2105LA5021, 2105LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-054) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fourth consecutive year, LDH did not perform five-year revalidations; screenings based on categorical risk of fraud, waste, or abuse; and monthly checks of the federal excluded party database, as required by federal regulations for all Medicaid and CHIP fee-for-service providers. Based on information provided by LDH, approximately 76% of providers with claims activity in fiscal year 2021 have not had a risk-based screening with a majority of those providers enrolled more than five years ago. In addition, LDH did not routinely check one of the required federal databases to determine if providers have been excluded from participation in federal programs. While LDH checked the List of Excluded Individuals/Entities (LEIE) on a monthly basis, it did not perform checks of the System for Award Management (SAM) monthly as required. Criteria: Providers are enrolled by LDH and can provide services to either Medicaid and/or CHIP recipients as applicable. 42 CFR 455, Subpart E, requires that LDH screen all providers according to the provider?s categorical risk level upon initial enrollment, re-enrollment, or revalidation of enrollment. LDH must complete a revalidation of enrollment for all providers, regardless of type, at least every five years. The required screening procedures for each provider varies based on the risk score ? limited, moderate, or high. For example, a high-risk score requires additional screening procedures including criminal background checks and fingerprinting. LDH submitted and received the Medicaid State Plan approval in fiscal year 2012 regarding compliance with revalidation and screening requirements. 42 CFR 455, Subpart E, required LDH to check the LEIE and the SAM on at least a monthly basis. The SAM database includes information on providers excluded from contracting with the federal government. Cause: In response to the prior year finding, LDH amended the Gainwell contract to accomplish provider revalidations with CMS-approved enhance funding. An online application portal was to be built by Gainwell and prepopulated with provider data. Through the portal, providers would be able to submit their enrollment applications online and Gainwell would revalidate them according to federal regulations. However, the enrollment portal created by Gainwell for providers was not launched after state fiscal year 2021. Effect: Proper enrollment and revalidation, including screening based on categorical risk and monthly checks of required databases, would enable the state to identify ineligible providers that should be rejected or excluded from the program. Recommendation: LDH should ensure all providers are screened based on categorical risk level upon initial enrollment, re-enrollment, and revalidation of enrollment as required by federal regulations. Also, LDH should perform revalidation of enrollment on all providers at least every five years. In addition, LDH should ensure all required databases are checked at least on a frequency required by federal regulations. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-50).

2021-064 - Noncompliance with Third-Party Liability Assignment Award Years: 2020, 2021 Award Numbers: 2005LA5021, 2005LA5MAP, 2105LA5021, 2105LA5MAP Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2020-055) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fifth consecutive year, LDH failed to maintain evidence of notification of third-party liability (TPL) assignment as required for eligibility in the Medicaid and the CHIP programs. Criteria: Per 42 CFR 433, Medicaid is the payer of last resort. As a condition of eligibility, each applicant/enrollee must assign to the state their individual rights to medical support and other third-party payments, and such rights of any other eligible individuals under their legal authority. By state law and per LDH policy, TPL assignment is automatic but notification must be provided to the applicant/enrollee. Cause: Historically, LDH provided notification to an applicant/enrollee by including assignment language on Medicaid and CHIP applications. LDH utilizes both paper and electronic applications. Prior to the new eligibility system, LaMEDS, implemented in 2018, TPL assignment language was not included as part of electronic application summaries in all recipient case records. LDH planned corrective action in conjunction with the launch of LaMEDS, but LDH?s corrective action was prospective in nature and did not attempt to remedy cases in which recipients with case files lacking TPL assignment notification do not complete a new application in LaMEDS. In response to the fiscal year 2020 finding, LDH planned to include the notification in Decision Letters for all approvals and renewals which each recipient would receive at least annually. Although the decision letters included the TPL assignment notification beginning in October 2020, LDH did not send the decision letters to most recipients/enrollees during fiscal year 2021 and was unable to provide adequate evidence regarding the number of recipients? case files still lacking the notification. Effect: Third parties are legally-liable individuals, institutions, corporations (including insurers), and public or private agencies who are or who may be legally responsible for paying medical claims. Without the assignment of TPL rights, the state may be at risk for payments that should be the legal obligation of another party. Recommendation: LDH should ensure notification of TPL assignment is provided to each recipient and support is maintained in each Medicaid and CHIP recipient case record as part of required documentation to support the eligibility decision. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-53).

2021-065 - Lack of Internal Controls over Program Expenditures Award Year: 2021 Award Number: NU50CK000532 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: OPH lacked internal controls to ensure compliance with regulations over the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program related to the activities allowed or unallowed and the allowable costs/cost principles compliance requirements. From a population of 714 payments occurring in fiscal year 2021 totaling $179,570,213, we selected a non-statistical sample of 60 payments made to vendors who provided services related to the ELC program. Based on our audit procedures, the following payments were noted with exceptions, some with multiple exceptions: ? Three (5%) were not approved by an appropriate supervisor. ? Five (8%) did not include enough information to determine if the expenditure was appropriate and in accordance with federal regulations. ? Eleven (18%) did not include enough information to determine if the account coding was accurate. Criteria: Per 2 CFR 200.302(a), each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-federal entity's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.302(b)(7) states the financial management system of each non-federal entity must provide for the written procedures for determining the allowably of costs in accordance with cost principles and the terms and conditions of the federal award. Cause: OPH did not establish adequate internal controls to ensure payments to vendors were properly supported and approved in accordance with federal regulations. Effect: Failure to adequately maintain supporting documentation and approve program expenditures increases the risk of unallowable costs requiring reimbursement to the federal grantor. The results of our procedures noted $4.8 million in questioned costs due to noncompliance. Recommendation: OPH should ensure that adequate internal controls are established and followed to ensure all expenditures of federal awards are adequately supported and approved by an appropriate supervisor. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-62).

2021-066 - Noncompliance with and Inadequate Controls over Subrecipient Monitoring Requirements at Pennington Biomedical Research Center Award Year: 2016 Award Numbers: 162025, P30DK072476 Compliance Requirement: Subrecipient Monitoring Pass-Through Entity: University of Texas Southwestern Medical Center Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Pennington Biomedical Research Center (PBRC) did not adequately monitor subrecipients of the federal R&D Cluster. PBRC did not have adequate controls in place to ensure that required audits were completed within nine months of the subrecipient?s fiscal year end. In a test of all PBRC subrecipients requiring monitoring of audit reports in fiscal year 2021, it was noted that for two out of 16 subrecipients (13%), PBRC was unable to provide documentation that ensured each subrecipient obtained the required audit within nine months of the subrecipient?s fiscal year-end, as required by federal regulations. Criteria: Per 2 CFR 200.332(f), pass-through entities are responsible for verifying that every subrecipient is audited as required by 2 CFR 200, Subpart F, when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501 of $750,000 or more in federal awards during the subrecipient?s fiscal year. 2 CFR 200.332(d)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings in accordance with 2 CFR 200.521, within six months after acceptance of the subrecipient?s audit report by the Federal Audit Clearinghouse, and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Cause: PBRC did not design or implement adequate controls to ensure that R&D Cluster award subrecipients were monitored in accordance with federal regulations regarding subrecipient audit requirements. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of improper payments which may have to be returned to the federal grantor. Recommendation: PBRC should design and implement controls to ensure the subrecipient has met its required audit requirements and that reviews of subrecipient audit reports are performed timely in order to evaluate the impact of any deficiencies noted and issue management decision letters, if applicable. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-73).

2021-067 - Weakness in Controls over Subrecipient Monitoring of R&D Projects Award Years: 2020, 2021 Award Number: R21AA026022 Compliance Requirement: Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LSUHSC-NO does not have adequate controls over subrecipient monitoring for the federal R&D Cluster to ensure that desk audits are completed timely and consistent with the risk assessment performed for the subrecipient. In a non-statistical sample of nine subrecipient contracts, from a population of 64 subrecipient contracts, one subrecipient (or 11%) did not have a desk audit until after the project was closed and the final Federal Financial Report (FFR) was submitted to the grantor. In addition, the subrecipient was identified as medium risk in the risk assessment performed with the initial award, which required two desk audits, but the contract only indicated that one desk audit was required. Criteria: 2 CFR 200.332 requires that the pass-through entity (PTE) (1) evaluate each subrecipient?s risk of noncompliance [2 CFR 200.332(b)], and (2) monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved [2 CFR 200.332(d)]. LSUHSC-NO?s Subrecipient Monitoring Policy states that the department administrator and principal investigator are responsible for desk audits, and that the desk audit must be completed based on terms of the subaward agreement. LSUHSC-NO?s Sponsored Projects Administration performs a risk assessment on every subrecipient and assigns a risk level. Per management, for each subrecipient contract?s funding or contract year, an assigned risk level of ?low? requires one desk audit; ?medium? requires two. ?High? risk subrecipients must undergo a desk audit for every invoice. This requirement is included in the terms and conditions of the subrecipient subcontract. Cause: LSUHSC-NO?s Subrecipient Monitoring Policy does not set desk audit requirements, such as the number of audits needed, based on the outcome of the risk assessment nor does the policy provide any guidance as to the timing of the required risk assessment and desk audit. Effect: Inconsistency between the results of a subrecipients risk assessment, and the stated terms and conditions of a subaward, increases the risk that desk audit requirements may not be communicated effectively, or that required desk audits may not be performed in a timely manner. Missed or untimely desk audits hinder management?s ability to monitor subrecipient expenditures and increase the risk that errors and omissions in payments to subrecipients may occur, remain undetected, and lead to inaccurate subrecipient expenditures being reported in FFRs and the SEFA. Recommendation: Management should revise its subrecipient monitoring policy to set desk audit requirements based on the outcome of risk assessments and ensure that the required number of desk audits specified in a subrecipient?s award match the results of the subrecipient?s risk assessment. Management should emphasize the importance of completing desk audits on a regular basis and establish a monitoring program to ensure that all desk audits are performed and completed timely. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-78).

2021-068 - Noncompliance with and Weakness in Controls over Subrecipient Monitoring Requirements Award Years: 2001, 2017, 2018 Award Numbers: H76HA00679, R01CA217180, R01DK111958 Compliance Requirements: Cash Management, Procurement and Suspension and Debarment, Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2020-60) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LSUHSC-S did not ensure that required audits were completed within nine months of the subrecipient?s fiscal year-end, as required by federal regulations. In addition, LSUHSC-S did not fully implement controls to evaluate subrecipient?s risk of noncompliance or make timely payments to subrecipient as required by federal regulations. In a test of all R&D Cluster projects with total payments to subrecipients that exceeded $25,000 for the fiscal year ended June 30, 2021, which included 11 subrecipient agreements with nine subrecipients, the following was noted: ? For five (45%) of 11 subrecipient agreements tested, LSUHSC-S did not evaluate the subrecipient?s risk of noncompliance with federal statutes, regulations, and terms and conditions on the subaward for determining appropriate subrecipient monitoring procedures. ? For three (33%) of nine subrecipients, LSUHSC-S did not receive an audit report to ensure that required audits were completed within nine months of the subrecipient?s fiscal year-end. ? For one (11%) of nine subrecipients, LSUHSC-S did not verify the entity with which it entered into a covered transaction is not debarred, suspended, or otherwise excluded. In a non-statistical random sample from a population of 96 subrecipient reimbursement expenses from the agreements noted above, LSUHSC-S did not make payment within 30 calendar days after receipt of the billing for eight of 23 (35%) subrecipient payments tested. Payment was made from three to 22 days beyond the 30 calendar days. Criteria: Per 2 CFR 200.332(b), pass-through entities must evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Per 2 CFR 200.332(f), pass-through entities are responsible for ensuring that subrecipients expending $750,000 or more in federal awards during the subrecipient?s fiscal year, meet the audit requirements of 2 CFR 200, Subpart F. Per 2 CFR 200.512, required audits must be completed within nine months of the end of the subrecipient?s audit period. 2 CFR 200.331(d)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings within six months after receipt of the subrecipient?s audit report and ensure that the subrecipient takes timely and appropriate corrective action on all findings. 2 CFR 200.318(h) requires the non-federal entity to award contracts only to responsible contractors possessing the ability to perform successfully under the terms and conditions of a proposed procurement. 2 CFR 180.300 requires the non-federal entity to verify that the person with whom you intend to do business is not excluded (suspended or debarred) or disqualified. 2 CFR 200.305(b)(3) requires pass-through entities, when using the reimbursement method, to make payment within 30 calendar days after receipt of the billing, unless the pass-through entity reasonably believes the request to be improper. Cause: LSUHSC-S did not obtain a signed Subrecipient Commitment Form from all subrecipients, which is used to evaluate each R&D Cluster award subrecipient?s risk of noncompliance with federal statutes, regulations, and terms and conditions of the subaward. Also, LSUHSC-S did not obtain a completed Subrecipient Monitoring Certification Letter and Subrecipient Profile Questionnaire from all subrecipients, which LSUHSC-S uses to ensure continued monitoring requirements are met. LSUHSC-S did not timely process subrecipient payments in accordance with federal regulations. Effect: Failure to properly monitor subrecipients, assess risk of noncompliance, and verify they are not debarred, suspended, or otherwise excluded results in noncompliance with federal regulations and increases the likelihood of improper payments, which may have to be returned to the federal grantor. Failure to make timely payments to subrecipients may result in the pass-through entity requesting reimbursement from the federal agency before the payment to the subrecipient is complete. Recommendation: Management should evaluate the effectiveness of established controls and implement revisions as needed to ensure LSUHSC-S evaluates each subrecipient?s risk of noncompliance, verifies audit requirements are met and evaluates the impact of any deficiencies noted, and ensures that the entity with which it entered into a covered transaction is not debarred, suspended, or otherwise excluded. In addition, management should ensure that subrecipient payments are processed timely and in accordance with federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-83).

2021-069 - Weakness in Controls with Special Tests and Provisions Requirements Award Years: 2018, 2020 Award Numbers: P20GM121307, R01CA240496 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2020-061) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, LSUHSC-S did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. We reviewed a non-statistical sample of seven federal R&D Cluster awards, plus an additional award tested based on materiality, for the fiscal year ending June 30, 2021, from a population of 68 awards. The awards tested had twelve key personnel and two (17%) had documentation of the key personnel?s effort that did not agree to the effort reported to the federal grantor, and there was no evidence of prior approval from the federal grantor for change in key personnel. Criteria: 2 CFR 200.308(c) states that for non-construction federal awards, recipients must request prior approvals from federal awarding agencies for one or more of the following program or budget-related reasons: (i.) Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). (ii.) Change in a key person specified in the application or the federal award. (iii.) The disengagement from the project for more than three months, or a 25 percent reduction in time devoted to the project, by the approved project director or principal investigator. Cause: Although LSUHSC-S has procedures in place for personnel to certify actual time and effort expended on federal awards, management represented that additional training of department personnel was needed on how to appropriately complete the Time and Effort Certification reports. LSUHSC-S held trainings in fiscal year 2021; however, the training and compliance review did not continue as originally planned due to staffing issues. In addition, there are no procedures in place to use the Time and Effort Certifications to monitor the effort of key personnel and verify that the principal investigator has obtained prior written approval from the federal grantor for changes in effort for key personnel. Effect: Failure to implement controls over key personnel requirements could result in noncompliance with Special Tests and Provisions requirements. Recommendation: Management should complete the necessary training for Time and Effort Certifications. Management should also utilize the Time and Effort Certifications to monitor changes in effort for key personnel and verify that prior written approval is obtained from the federal grantor for changes that exceed the thresholds set in federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action (B-87).

2020-006 - Inadequate Controls over Payroll Award Year: 2020 Award Numbers: NU62PS005012, NU62PS005022, NU62PS924522, NU90TP922016, SLT0084 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Louisiana Department of Health, Office of Public Health (OPH) did not ensure payroll expenditures were timely approved for the Public Health Emergency Preparedness program, the HIV Prevention Activities Health Department Based program, and the Coronavirus Relief Fund (CRF) program. In addition, expenditures were not adequately supported for the HIV Prevention Activities Health Department Based program, which resulted in noncompliance. Exceptions for each federal program are as follows: ? For the Public Health Emergency Preparedness program, we selected a non-statistical sample of 34 payroll transactions tested from a population of 1,138 transactions totaling $2,364,950. Six (18%) were not approved by the employees? supervisors. ? For the HIV Prevention Activities Health Department Based program, we selected a non-statistical sample of 11 payroll transactions tested from a population of 796 transactions totaling $250,120. Four (36%) were not approved by the employees? supervisors and three (27%) did not include documentation, such as a time statement to support expenditures totaling $3,151. ? For the CRF program, we selected a non-statistical sample of 63 payroll transactions tested from a population of 7,244 transactions totaling $15,444,856. Eleven (17%) were not approved by the employees? supervisors. As a result of the high exception rate of payroll transactions that were not approved by the employees? supervisors noted above, we performed additional audit procedures to determine the exception rate of time statements that were not approved for all OPH employees during the entire fiscal year. OPH uses electronic time statements, which allows for an electronic determination of supervisor approval. Based on audit procedures conducted on all payroll transactions in fiscal year 2020, we identified 3,672 (10%) of 35,301 time statements that were not approved by the employees' supervisors. Criteria: Per 2 CFR 200.302(a), each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-federal entity's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.430(i) states that records must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Furthermore, the records must comply with the established accounting policies and practices of the non-federal entity. Cause: OPH lacked sufficient controls to ensure electronic time statements were properly supported and approved prior to the posting date in accordance with federal and state regulations. Effect: Failure to adequately maintain supporting documentation and approve program expenditures increases the risk that unallowable costs could be reimbursed to the federal grantor. Recommendation: OPH should ensure employees comply with existing policies and procedures, including properly approving electronic time statements in a timely manner and maintaining adequate documentation to support all expenditures of federal awards. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-60).

2020-007 - Noncompliance with and Inadequate Controls over Federal Special Tests and Provisions Requirements at LSU A&M and the LSU Agricultural Center Award Year: 2020 Award Numbers: 2019-67021-29449, DE-SC0010431, M15AC00013, PHY-1505779 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2019-015) See Schedule of Findings and Questioned Costs for chart/table Condition: Louisiana State University and A&M College (LSU A&M) and the LSU Agricultural Center (AgCenter), for the third and fourth consecutive year, respectively, did not have adequate preventative controls in place to ensure compliance with Special Tests and Provisions requirements. In a non-statistical sample of 80 LSU A&M federal Research and Development (R&D) Cluster awards from a population of 601 LSU A&M awards subject to Special Tests and Provisions, LSU A&M records for two (3%) of the awards tested did not contain evidence that the key personnel requirements applicable to each award were met during fiscal year 2020. In addition, in a non-statistical sample of 52 AgCenter federal R&D Cluster awards from a population of 130 AgCenter awards subject to Special Tests and Provisions, AgCenter records for two (4%) of the awards tested did not contain evidence that the key personnel requirements applicable to each award were met during fiscal year 2020. Criteria: 2 CFR 200.308(c)(i)-(iii) states that for non-construction federal awards, recipients must request prior approvals from federal awarding agencies for one or more of the following program or budget-related reasons: (i.) Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). (ii.) Change in a key person specified in the application or the federal award. (iii.) The disengagement from the project for more than three months, or a 25% reduction in time devoted to the project, by the approved project director or principal investigator. Cause: LSU A&M and the AgCenter did not have adequate preventative controls in place to ensure that the Principal Investigator met the key personnel requirements. After discussions with management, it was determined that current internal controls only detected noncompliance after the fact. Effect: Failure to implement preventative controls over key personnel requirements could result in noncompliance with Special Tests and Provisions requirements. Recommendation: LSU A&M and the AgCenter should design and implement preventative controls over key personnel requirements that ensure key personnel requirements are being followed and any required prior approvals of changes are obtained from the federal awarding agency. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-73).

2020-008 - Weaknesses in Controls over Federal Research and Development Expenses Award Years: 2015, 2017 - 2020 Award Numbers: P01AI127335, P20GM103424, P20GM121307, P30GM110703, R01AA023610, R01AI056077, R01CA211576, R01CA226285, R01CA242839, R01DE025565, R01DK107572, R01DK111958, R01EY025632, R01HL098435, R15ES029704, R15GM131226, R15HL141998, R21AA025744, R44AI103982, R56HL125572, UG1CA189854, W81XWH-17-1-0417 Compliance Requirements: Allowable Costs/Cost Principles, Period of Performance Pass-Through Entities: Inhibikase Therapeutics, Oregon Health & Science University, University of Arkansas System Repeat Finding: Yes (Prior Year Finding No. 2019-037) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, the Louisiana State University Health Sciences Center in Shreveport (LSUHSC-S) did not ensure internal control over documentation of personnel services were operating effectively. In a non-statistical sample of 71 out of 16,764 payroll and non-payroll expense transactions charged to the R&D Cluster, we noted the following: ? Twenty-seven (38%) time and effort certifications were completed 13 to 275 days after the date required by policy. ? Five (7%) transactions indicated an untimely discovery and correction of errors. The adjustments were made 122 to 529 days after the original transactions were recorded and 91 to 457 days after the quarter end date for the applicable time and effort certification report. After the adjustments, the costs in the accounting system allocated to the grant do not agree to the time and effort supported by the certification. ? One (1%) transaction on February 29, 2020, was for costs incorrectly allocated to an award because there were no funds remaining on the award, and there was no adjustment to re-allocate the costs as of June 30, 2020, more than 122 days after the original transaction was recorded. Criteria: 2 CFR 200.430(i)(1)(i) requires that charges to federal awards for salaries and wages must be supported by a system of internal control which provides a reasonable assurance that the charges are accurate, allowable, and properly allocated. Per 2 CFR 200.430(i)(1)(viii), budget estimates alone do not qualify as support for charges to federal awards, but may be used for interim accounting purposes, provided that significant changes in work activity are identified and entered into the records in a timely manner and the non-federal entity?s system of internal controls includes processes to review after-the-fact charges and make necessary adjustments. Per LSUHSC-S?s Time and Effort Certification Policy and Procedures, LSUHSC-S utilizes Time and Effort Certifications to support salary charges on sponsored projects as an after-the-fact certification of effort, allowing for adjustments to be made to reflect final amounts charged. Based on the LSUHSC-S?s policy, the time and effort certifications should be completed within approximately 30 days of the end of the quarter. Per 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award. These internal controls should follow guidance in the ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Standards for Internal Control in the Federal Government, examples of common categories of control activities include accurate and timely recording of transactions. In addition, the National Institute of Health (NIH) is the grantor for the majority of the LSUHSC-S?s R&D grant awards. Per the NIH Grants Policy Statement, recipients must maintain documentation of cost transfers and should have systems in place to detect such errors within a reasonable time frame. Cause: Although management has procedures in place for personnel to certify actual time and effort expended on federal awards, management has represented that additional training of department personnel is needed on how to appropriately complete the time and effort certification reports and plans to provide training were delayed due to Coronavirus Disease 2019 (COVID-19) office closures and telework. Effect: Untimely certifications and the untimely discovery and correction of errors increases the risk of inaccurate reporting and may result in an inability to complete approved projects within the approved budget and/or period of performance. As a result, LSUHSC-S may have to utilize university funds to complete the approved project. Recommendation: Management should monitor time and effort certifications completed by the departments and investigate and obtain justification from department personnel for untimely certifications and untimely discovery and correction of errors to enforce policies established. Management should also consider implementing other complementary controls such as preventing costs from being charged to projects in the accounting system beyond the approved budget or period of performance. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-82).

2020-009 ? Noncompliance with Civil Service Rules Regarding Special Leave Award Years: 2017 - 2020 Award Numbers: AA-30955-17-55-A-22, AA-32201-18-55-A-22, AA-33232-19-55-A-22, UI-32842-19-60-A-22, UI-34061-20-55-A-22 Compliance Requirement: Allowable Costs/Costs Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Louisiana Workforce Commission?s (LWC) use of Special Leave - Act of God (SLAG) was not in accordance with State Civil Service Rules (CSR) and may have resulted in improper compensation totaling approximately $786,000. Audit procedures performed regarding the use of SLAG identified the following: ? LWC granted $1.7 million of SLAG to 792 employees between March 23, 2020, and April 19, 2020. Based on a non-statistical sample of 91 employees paid $197,616 in SLAG, 49 (54%) employees may have been improperly compensated $81,469 for SLAG in addition to compensation for the time actually worked. Of this amount, $76,501 was charged to federal programs, which we consider to be questioned costs. ? Further procedures were performed to identify instances when employees recorded SLAG and overtime on the same day. Based on these procedures, we determined that from March 26, 2020, through April 14, 2020, LWC employees may have been improperly granted nearly 33,560 of SLAG hours totaling approximately $786,000 in compensation. Criteria: On March 19, 2020, State Civil Service issued General Circular 2020-014, which included clarification that CSR 27.2(b) Special Paid Leave granted the appointing authority great discretion to grant special paid leave under CSR 11.23(d) Act of God. CSR 11.23(d) provides that SLAG can be granted ?When the appointing authority determines the employee cannot work due to an act of God.? State Civil Service General Circular Numbers 2020-017 and 2020-022 demonstrate that the Emergency Rules issued by State Civil Service General Circular Number 2020-013 on March 18, 2020, supersede agency leave rules regarding the response to COVID-19. Nothing in the Emergency Rules allows for the payment of both SLAG and straight time overtime for hours actually worked. Agencies were specifically advised by these Circulars that the rules regarding official office closures ?do not apply at this time.? On March 22, 2020, the governor issued Proclamation 33 JBE 2020, directing that all state office buildings be ?closed to the public effective immediately. However, essential state functions shall continue.? The Governor?s proclamation was not an ?official? office closure. While overtime is allowable under CSR 21.7(b)(4) during an official office closure, this rule was not in effect because LWC was not officially closed. 2 CFR 200.430 requires that compensation must be reasonable for the services rendered and conforms to the established written policy of the non-federal entity consistently applied to both federal and non-federal activities. Cause: From March 26, 2020, through April 14, 2020, LWC paid employees who actually worked both SLAG plus ?straight time overtime? for the hours actually worked. Any hours actually worked over 40 hours in one work week were paid at time and a half. For example, during this time period an LWC employee who actually worked 50 hours in a work week received 95 hours total compensation (40 hours SLAG, 40 hours at straight time overtime and 10 hours at time and a half overtime). Employees who were prevented from working or for whom it was impracticable to come in to work should have been granted SLAG. LWC employees who actually worked should have been paid straight salary only plus time and a half overtime for any hours worked over 40 in a work week pursuant to CSR 27.5, whether exempt or nonexempt. Effect: Failure to follow State Civil Service Rules and guidance could result in improper compensation to employees, and in disallowed costs resulting from improper charges to federal programs. Recommendation: LWC should work with State Civil Service in the development of future additional compensation policies or plans to avoid violation of State Civil Service Rules and contact State Civil Service if clarification of rules or guidance is necessary. In addition, LWC should seek legal advice regarding the recoupment of any improper compensation. Management?s Response and Corrective Action Plan: Management did not concur with the finding, and noted that it properly compensated its employees within the constraints of the Civil Service Commission Rules and Louisiana law (B-92). Auditor?s Additional Comments: Based on its response, LWC continues to comingle State Civil Service Emergency Rules regarding COVID-19 and its overtime compensation policies, resulting in a method of payment that was improper. Agencies were required to abide by the Emergency Leave Rules regarding compensation during this time period to address the COVID-19 pandemic. SLAG time compensation should have been used for those employees who were prevented from work or for whom it would be impracticable to work due to COVID-19, not as additional compensation for those employees who did work. Also, the Governor?s proclamations closing state offices to the public were not official ?office closures.? Normal functions for the state agencies were not altered or suspended. Therefore, employees who actually worked during the time period were not entitled to ?straight time overtime? in addition to SLAG time for working during ?office closures.? As part of our due diligence in reporting this noncompliance, auditors sought guidance from State Civil Service about the rules and regulations in effect during this time period. This finding included consideration of that guidance.

2020-010 ? Inadequate Grant Recovery of Homeowner Assistance Program Awards Award Years: 2006 - 2008 Award Numbers: B-06-DG-22-0001, B-06-DG-22-0002, B-08-DG-22-0003 Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2019-008) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2020, the DOA, Office of Community Development (OCD), Disaster Recovery Unit (DRU) identified $38,359 in noncompliant Homeowner Assistance Program (HAP) awards for two homeowners through post-award monitoring for the Community Development Block Grant/State?s Program (CDBG). Because these noncompliant awards have not been recovered as of June 30, 2020, we consider the amounts as questioned costs. In addition, 27,932 noncompliant files totaling $930.6 million identified in previous years are still outstanding. Of this total, OCD is actively pursuing collections on 15,721 files totaling $555.9 million and the remaining 12,211 files totaling $374.7 million have been determined uncollectable for various reasons such as death or bankruptcy. As of June 30, 2020, $8.9 billion in total HAP awards have been disbursed to 130,053 homeowners. At year-end, OCD was actively reviewing files for 383 applicants totaling $12.4 million to make final determinations of the homeowner?s noncompliant status or final assessment of the collectability of accounts determined to be noncompliant. In addition, OCD reported that the following progress was made during fiscal year 2020: 43 files were submitted to a law firm to pursue collection efforts; 150 applicants requested a plan for payment; and 256 files with obligations were paid off or were cleared. Criteria: Office of Management and Budget (OMB) Circular A-87, Cost Principles for State, Local, and Indian Tribal Governments, stipulates that for costs to be allowable for reimbursement by a federal program, the cost must be adequately supported and comply with all terms and conditions of the award and that the state assume responsibility for administering federal awards in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to hurricanes Katrina and Rita, the state was awarded approximately $9.5 billion to administer HAP as part of the Road Home program, in accordance with its Action Plan approved by the U.S. Department of Housing and Urban Development (HUD). The state?s Action Plan stipulates that eligible homeowners must agree in legally-binding documents, referred to as covenants, to follow through on certain future actions in exchange for up to $150,000 in compensation for their damaged property. Funds are disbursed to the homeowner upon the effective date of signing the covenant, which is referred to as the closing date. Homeowners agree in the covenant to provide OCD with evidence that they will occupy their damaged property or replacement property within three years of the closing date, maintain homeowner?s insurance on their property, maintain flood insurance if necessary, and ensure that any required elevation conforms to the advisory base flood elevation regulation for the parish in which their home is located. The state?s Action Plan states that homeowners who fail to meet all of the program?s requirements may not receive benefits or may be required to repay all or some of the compensation received back to the program. Cause: In the initial stages of the program, OCD focused on making payments to disaster victims as quickly as possible, because the state had made a decision to accept additional risks associated with expedited payments with the understanding that any ineligible or unallowable payments would be detected and corrected in post-award monitoring. Awards are included in grant recovery because of duplication of benefits (homeowner?s insurance proceeds or other federal assistance), lack of documentation evidencing owner-occupancy of the property, and noncompliance with one or more award covenants. In addition, individual homeowner awards have been identified for grant recovery because of errors made by the program?s former contractor, ICF International Inc., in determining the grant calculation or obtaining the required documentation. In August 2015, HUD amended the grant terms and conditions to formalize a partnership between the state and HUD and created the Road Home closeout plan, which continues to address noncompliance. Additional opportunities allow for the review of awards to determine if any unmet needs or additional assistance is necessary for participants to return home, including reclassification of the Road Home Elevation Incentive award and allowing interim housing as an unmet need. OCD has forwarded noncompliant awards to a law firm for collection in accordance with the Road Home closeout plan. Effect: OCD?s failure to recover benefits from noncompliant homeowners could result in disallowed costs. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of these awards. Recommendation: OCD should continue its recovery efforts to collect those awards determined to be noncompliant. Management?s Response and Corrective Action Plan: OCD?s response indicates concurrence with the finding stating that OCD will continue its efforts to recover those awards determined to be ineligible in accordance with policies and procedures that are acceptable to HUD. OCD?s response also indicates that OCD will continue to work with homeowners to become compliant and resolve grant compliance issues in order to reduce or eliminate the need to recapture funds from homeowners where appropriate (B-21).

2020-011 ? Inadequate Recovery of Small Rental Property Program Loans Award Years: 2006, 2007 Award Numbers: B-06-DG-22-0001, B-06-DG-22-0002 Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2019-009) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2020, the DOA, OCD-DRU identified $34,233,732 in Small Rental Property Program (SRPP) loans for 321 property owners under the CDBG program who failed to comply with one or more of their loan agreement requirements and were assigned to loan recovery status. Since OCD has not recovered these loans, we consider these amounts totaling $34,233,732 to be questioned costs. In addition, 916 noncompliant loans identified in previous years totaling $80.2 million remain outstanding. As of June 30, 2020, of the 4,486 outstanding SRPP loans totaling $436.6 million, 1,078 noncompliant loans totaling $100.2 million are in active recovery status, and OCD represented that current recovery efforts are to either recoup the loan funds or work with the applicants to bring them into compliance with the state?s continuing requirements of the program. The remaining 159 noncompliant loans totaling $14.3 million have been determined by OCD to be uncollectable for various reasons such as foreclosure, property seizure, or legal dispute. Criteria: OMB Circular A-87, Cost Principles for State, Local, and Indian Tribal Governments, stipulates that the state assume responsibility for administering federal awards in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to hurricanes Katrina and Rita, the state was awarded and has allocated approximately $653 million to the SRPP, as part of the Road Home program. In accordance with the state?s HUD-approved Action Plan Amendment 24, the SRPP offers forgivable loans to qualified property owners who agree to offer rental properties at affordable rents to be occupied by lower-income households. In exchange for accepting loans ranging between $10,000 and $100,000 per rental unit, property owners are required to accept limitations on rents and incomes of renters during an ?affordability period,? a specified period of time based on the amount of funding received and the type of work being done (renovation or full construction) ranging between three and 20 years. The loan amounts are determined based on location of property, number of bedrooms, and the poverty level of the renter. In addition to accepting limitations on rents and income of renters, property owners also agree to maintain property insurance and maintain flood insurance, if necessary. These requirements become effective one year after the closing date and remain until the expiration of the ?affordability period.? According to the loan agreements, failure to comply with any of the loan requirements shall constitute default and mandatory repayment. Good internal controls would ensure that policies and procedures are in place with an established timeline to monitor compliance with the loan agreements and provide for specific actions (i.e., loan modification, foreclosure, or repayment) if a property owner fails to comply with the loan agreement or does not provide evidence of compliance as required by the loan agreement. Cause: In June 2016, HUD issued a monitoring review report that included a finding that states the SRPP design lacked sufficient fiscal accounting controls and procedures to ensure that CDBG funds identified as ineligible expenses are able to be recaptured and repurposed for eligible uses. In HUD?s May 2017 monitoring report, HUD noted that Louisiana has made significant progress on reviewing the SRPP documentation and implementing the corrective actions described in the June 2016 monitoring report. In HUD?s February 2020 monitoring report, HUD reported that OCD is exploring all options to assist as many applicants in reaching compliance as possible. Nonetheless, OCD is prepared to employ the judicial foreclosure process as a potential option where no other remedy is available. HUD will continue to work with OCD to determine final enforcement procedures and potential recapture amounts. HUD stated that OCD must complete its selection of the properties going to public auction before the end of 2020. Effect: Ultimately, OCD?s failure to recover loans from noncompliant property owners could result in disallowed costs. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of the awards. Recommendation: OCD should continue its monitoring to identify awards to be placed in recovery and continue the corrective actions as recommended by HUD to recover funds from noncompliant property owners. Management?s Response and Corrective Action Plan: OCD stated in its response that it will continue the efforts to recover ineligible awards and will continue to work with rental property owners to become compliant and resolve loan compliance issues to reduce or eliminate the need to recapture funds from rental property owners (B-23). Auditor?s Additional Comments: OCD?s response notes that those files determined to have satisfied a HUD National Objective, but not the state?s continuing program requirements, are not subject to repayment to HUD. However, OCD could not provide communications from HUD supporting this statement. Therefore, we continue to identify these files as questioned costs.

2020-012 - Inadequate Controls over and Noncompliance with Unemployment Insurance Benefits Requirements Award Year: Not Applicable Award Number: Not Applicable Compliance Requirements: Activities Allowed or Unallowed, Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Louisiana Workforce Commission (LWC) did not have adequate internal controls and did not comply with requirements of the Unemployment Insurance (UI) federal program. In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which included funding for new UI programs. These new programs are funded entirely with federal funds and include the Pandemic Unemployment Assistance (PUA) program and the Federal Pandemic Unemployment Compensation (FPUC) program. The PUA extended unemployment benefits to claimants that did not qualify for UI but had lost their job due to the COVID-19 pandemic, including those that were self-employed and gig workers. FPUC provided claimants receiving UI or PUA benefits an extra $600 per week. Because of the large amount of funding provided and the lack of identity requirements, these programs have been exposed to identity theft and fraud schemes across the United States of America. Between March 14, 2020, and June 30, 2020, LWC issued more than $3.7 billion in benefit payments to more than 575,000 claimants. We tested a non-statistical random sample of 138 claimants who were paid $902,822 in unemployment benefits between March 14, 2020, and June 30, 2020. Ninety-seven of the claimants received UI/FPUC benefits and 41 received PUA/FPUC benefits. Our audit procedures identified the following: ? Thirty-seven (27%) of the claimants reviewed who were paid $261,063 had inconsistent or missing information on the UI application, which may indicate the claimant is intentionally filing to receive benefits that they are not entitled, or that may indicate possible identify theft. These inconsistencies included job history information on the application that did not agree with the UI database; incomplete job information on the application; questionable and contradictory personal contact information including email, telephone number, and address when compared with work location; contradictory information about the last day of work; and unusual age of applicant. In addition, the claimant may have certified for weeks that they were still unemployed although their job sector had returned to work. Of these 37 claimants, 23 have since been flagged by LWC for investigation or to provide proof of identity. These 23 claimants were paid $162,170 through June 30, 2020, and these payments may ultimately be determined to be overpayments. Those that are potentially fraudulent, including possible identity theft, will be turned over to law enforcement agencies. We consider the $261,063 to be questioned costs. ? Deductions were not properly withheld for five (4%) of the 138 claimants reviewed. All five of these exceptions related to child support deductions. Louisiana Revised Statute 23:1693 requires child support to be deducted from unemployment compensation when notified by the Department of Children and Family Services (DCFS). The notification received from DCFS states that the deduction should start within seven days. Three of the cases were set up between one to three months after LWC received the child support enforcement notice. One case had not been set up in the seven months since receiving the enforcement notice. One case has a termination notice on file from a previous claim to end the deduction and the child support is still being deducted. In addition, during the course of our procedures, four claimants were identified that received benefit payments from two different federal programs for the same weeks. These claimants had exhausted their UI claim and were moved to the PUA program. The PUA claim was backdated, causing duplicate payments for weeks the claimant had received benefits under UI. When brought to LWC?s attention, LWC set up $25,943 in overpayments on these claims and corrected the funding sources associated with these claims. We consider the duplicated payments totaling $25,943 to be questioned costs. We did not note any of these issues during our testing of the sample noted above. The U.S. Department of Labor issued guidance on January 8, 2021, to require identity verification of PUA applicants. LWC has represented that this guidance is now being followed for all applicants, which should reduce the risk of overpayments or payments to ineligible claimants. Criteria: 2 CFR 200.303(a) requires that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. 2 CFR 200.302(b)(4) states the financial management system of each non-federal entity must provide effective control over, and accountability for, all funds, property, and other assets. The non-federal entity must adequately safeguard all assets and assure that they are used solely for authorized purposes. 20 CFR 625 (Appendix C Section 7511) states the Secretary of Labor interprets the Social Security Act [Section 303(a)(1)] to require that a state law include a provision for such methods of administration as are, within reason, calculated (1) to detect benefits paid through error by the agency or through willful misrepresentation or error by the claimant or others, and (2) to deter claimants from obtaining benefits through willful misrepresentation. 20 CFR 625.6 states the amount payable to an unemployed worker or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable state law for a week of total unemployment. In no event shall such amount be in excess of the maximum amount of regular compensation authorized under the applicable state law for that week. Per R.S. 23:1601(8)(a), individuals are disqualified for benefits for the week, or fraction thereof, with respect to which he makes a false statement or representation knowing it to be false, or knowingly fails to disclose a material fact in obtaining or increasing benefits, whether or not he is successful in obtaining or increasing benefits, or otherwise due to his fraud receives any amount as benefits under to which they are not entitled. R.S. 23:1693 requires child support to be deducted from unemployment compensation when notified by DCFS. The notification received from DCFS states that the deduction should start within seven days. Cause: Prior to the payment of claims during the COVID-19 pandemic, LWC failed to implement adequate internal controls to identify possible fraud or disqualification from the UI program and to ensure duplicate payments were not made. In addition, LWC represented it had limited personnel to set up child support deductions which created a backlog of these deductions. Effect: Failure to implement internal controls that will identify possible fraud or disqualification from the programs can lead to overpayments that LWC may not be able to collect if correct personal identifying information is not obtained prior to the payment of claims. Failure to properly withhold child support payments results in noncompliance with state laws. By backdating the PUA claims and thus, duplicating payments, LWC is noncompliant with federal program regulations. Recommendation: LWC should evaluate the controls in place when implementing new programs to ensure that improper payments are minimal to reduce the risk of noncompliance. In addition, LWC should take the necessary actions to ensure child support deductions are setup timely to address the noted backlog and to ensure LWC is compliant with applicable laws. Finally, LWC should establish internal controls to ensure duplicate payments are not made from multiple programs and review other claimants that have a similar situation as the exceptions noted above to ensure that there are no other instances of duplicate payments and incorrect coding of funding sources. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and outlined a plan of corrective action. Management agreed that proper internal controls should be put in place before implementing a program, but noted that states were given little time, insufficient guidance, and had inadequate resources while managing record-breaking surge in claim volume (B-85).

2020-013 - Inadequate Source Code Escrow Agreement Award Year: Not Applicable Award Number: Not Applicable Compliance Requirement: Other Repeat Finding: Yes (Prior Year Finding No. 2019-010) See Schedule of Findings and Questioned Costs for chart/table Condition: LWC?s original contract with Geographic Solutions, Inc. (GSI) was inadequate as of June 30, 2020, as it did not account for the infrastructure and other systems the Helping Individuals Reach Employment (HiRE) system?s source code requires for execution. LWC contracts with GSI as a sole source provider of the HiRE system. The HiRE system is used to administer the state?s UI program, and GSI performs critical services without which LWC could no longer operate the program. LWC amended the contract to provide for extended escrow services, and both LWC and GSI signed this addendum in October 2020. However, as of December 2020, the escrow fees have not been paid; therefore, the source code has not been provided to the escrow agent. This is the fourth consecutive audit that LWC?s contract with GSI lacks an adequate and fully executed source code escrow agreement. Criteria: Good internal controls over information technology (IT) contracts should ensure the inclusion of certain key terms in IT agreements, including a source code escrow clause that would protect the entity upon contractual default of the contractor, and that those key terms are executed. Cause: As of June 30, 2020, LWC did not ensure that all key terms were included in a signed contract with GSI and that those key terms were fully executed. Effect: LWC may be unable to use the source code in the event of GSI?s contractual default. Recommendation: Management should take the actions necessary to ensure the key terms are included in the escrow agreement and are fully met. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-91).

2020-014 ? Noncompliance with Subrecipient Monitoring Requirements Award Years: 2017 - 2019 Award Numbers: AA-28319-16-55-A-22, AA-30955-17-55-A-22, AA-32201-18-55-A-22, AA-32232-19-55-A-22 Compliance Requirement: Subrecipient Monitoring Repeat Finding: Yes (Prior Year Finding No. 2019-011) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LWC did not adequately monitor subrecipients under the Workforce Innovation and Opportunity Act (WIOA) Cluster programs. WIOA program expenditures totaled $41 million during fiscal year 2020, with approximately $36.5 million provided to subrecipients who were not adequately monitored. Although LWC conducted annual site visits and monitoring reports were issued on each of the 15 subrecipients under the WIOA program, LWC did not adequately document or monitor the activities as necessary to ensure that the subaward was used for authorized purposes, complied with the terms and conditions of the subaward, and achieved performance goals. Audit procedures for five of the subrecipients revealed the following deficiencies: ? LWC did not perform adequate risk assessment procedures for any of the five subrecipients reviewed (100%) in order to evaluate the subrecipients? risk of noncompliance. Risk of noncompliance should be performed to determine the appropriate level of monitoring needed and should include consideration of the subrecipients? prior experience; previous audits, including the subrecipient?s Single Audit; change in subrecipient personnel or system changes; and results from federal awarding agency monitoring. ? Three of the reports reviewed cited findings and potential questioned costs. However, LWC did not document the resolution of these possible questioned costs. ? LWC did not maintain adequate documentation to support the conclusions in its monitoring reports. For three of the five subrecipients reviewed, there was no support, and for one of the five, the support was inadequate. None of the five reports showed evidence of supervisory review. In addition, LWC did not have adequate controls in place to ensure that required audit reports for the subrecipients were reviewed and that management decisions were issued for any findings to ensure timely and appropriate corrective action by subrecipients. Decision letters are due six months after the reports are due. For the two subrecipients who had audit findings, LWC had not issued decision letters. At the time of our request, the audit reports had been issued for approximately one year. Criteria: 2 CFR 200.331(b) requires that the pass-through entities evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring of the subrecipient. 2 CFR 200.331(d) requires that pass-through entities monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. 2 CFR 200.331(d)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings within six months after receipt of the subrecipient?s audit report and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. 20 CFR 667.410(b)(2) and (b)(3) requires that LWC?s monitoring system provide for annual on-site monitoring reviews of its subrecipients? compliance with the federal uniform administrative requirements and include reviews of its subrecipients? fiscal and administrative functions. Cause: LWC has not placed sufficient emphasis on implementing internal controls to ensure that risk assessment procedures are performed and internal monitoring reports issued by the Office of Workforce Development Compliance and Monitoring Division are adequately prepared, supported, and reviewed prior to issuance. In addition, LWC has not placed sufficient emphasis on implementing internal controls to ensure any reported findings are followed up on to verify corrective action is taken in a timely manner. Effect: Failure to perform adequate monitoring impairs LWC?s ability to ensure that program funds passed through to its subrecipients are spent in accordance with program regulations and increases the risk of improper payments which LWC may have to repay to the federal grantor. Recommendation: LWC should require that monitoring reports are properly reviewed and adequately supported before they are issued. This includes implementing an overall risk assessment policy to ensure that risk assessments are performed and documented on all subrecipients to determine the appropriate level of monitoring. In addition, LWC should strengthen controls to ensure the timely review of all required subrecipient audit reports in order to resolve any audit findings and questioned costs. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-95). Auditor?s Additional Comments: In LWC?s response, management noted that the reports reviewed by the auditor had not been completed and that the final reports address the potential questioned costs or other findings, assigned corrective actions to remedy findings, and included a documented resolution. The reports auditors reviewed were dated in May 2020. According to LWC?s policy, the subrecipient will submit a corrective action plan to LWC within 45 days of the issuance of the monitoring report. At the time of our review in October 2020, there was no documentation for the resolution of the findings.

2020-015 - Weak Security Controls Award Year: Not Applicable Award Number: Not Applicable Compliance Requirements: Activities Allowed or Unallowed, Eligibility, Reporting, Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2019-012) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LWC did not have adequate security controls over the Louisiana Wage and Tax System (LaWATS) and the UI mainframe. LaWATS is a portal that allows employers to enter wages, and it interfaces with the UI mainframe, which contains employment tax records. Both systems are utilized for the UI program. Criteria: Adequate information technology controls include protecting information to maintain the level of information security risk acceptable to the organization in accordance with the security policy and performing security monitoring. Cause: LWC has not established responsibilities for monitoring Office of Technology Services (OTS) employees with access to the operating systems and databases for LaWATS and the UI mainframe to ensure they have a valid business need. Effect: Without adequate monitoring, LWC may be unable to detect unauthorized user access to LaWATS and the UI mainframe. Inadequate security of LWC?s systems may lead to unauthorized view or theft of unemployment insurance and tax data, or noncompliance with privacy laws. Recommendation: LWC should establish responsibility for regular monitoring of OTS employees with access to LaWATS and the UI mainframe. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-97).

2020-016 - Deficiencies in Controls over Electronic Payroll Certifications and Approvals Award Years: Various Award Numbers: Not Applicable Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Transportation and Development (DOTD) did not have adequate controls in place to ensure that all electronic time sheets, including those employees charging to federal programs, were certified and approved in a timely manner. DOTD utilizes electronic time sheets in the Cross-Application Time Sheet (CATS) system, a computer-based application accessed through Louisiana Employees Online (LEO), for approximately 1,444 (34.5%) of its 4,181 total employees. In a non-statistical sample of 22 electronic time sheets tested from a population of 1,444, one (4.5%) time sheet was not approved by the employee?s supervisor. Based on these results, we performed additional procedures on system reports of the 34,421 electronic time sheets processed in CATS from July 1, 2019, through June 30, 2020, and noted the following: ? 509 (1.5%) time sheets were not certified by the employee. ? 812 (2.4%) time sheets were certified by the employee from three to 132 days after the payroll posting date. ? 1,436 (4.2%) time sheets were not approved by the supervisor. ? 1,603 (4.7%) time sheets were approved by the employees? supervisor from three to 139 days after the payroll posting date. Criteria: Louisiana Civil Service Rule 15.2, Certification of Payroll and Attendance, requires each classified employee and appointing authority to certify on each payroll that the actual service was rendered, the actual number of hours of attendance on duty, and the number of hours absence from duty. DOTD?s Administrative Manual, Section 3.17, requires employees and supervisors to certify and/or approve time statements for accuracy by 10:00 p.m. on the Wednesday following the close of the pay period (payroll posting date). Time administrators are responsible for reviewing the LaGov ZP241 eCertification Report prior to payroll processing to identify any employees who have not certified their timesheet and any supervisors who have not approved their staff?s time sheets. 2 CFR 200.430 requires that records must be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Cause: DOTD did not place sufficient emphasis on ensuring electronic time sheets were properly certified and approved prior to the payroll posting date. Effect: Electronic time and attendance records were not properly certified, approved, and monitored, which increases the risk of payroll error or fraud and may result in disallowed costs. Recommendation: Management should ensure employees comply with existing policies and procedures, including properly certifying and approving electronic time sheets in a timely manner. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-120). Auditor?s Additional Comments: In its response, management stated recertifications of time sheets due to prior-period adjustments would override any previous system certifications or approvals. The auditor excluded time sheets that were marked as changed after certification in the system from finding results presented above.

2020-017 - Untimely Submission of Summary of Samples and Test Results Form Award Years: 2007, 2013 - 2019 Award Numbers: Not Applicable Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2019-013) See Schedule of Findings and Questioned Costs for chart/table Condition: DOTD did not have adequate controls in place to ensure the Summary of Samples and Test Results Form (Form 2059), which is part of DOTD?s project close-out documentation, was completed timely for projects of the Highway Planning and Construction Cluster (HPCC). DOTD?s Construction Contract Administration Manual requires the Summary of Samples and Test Results Form to be submitted with the project close-out documentation. In practice, DOTD requires this form to be submitted within 90 days of final acceptance of the project. The Summary of Samples and Test Results Form is certified by applicable engineers and includes documentation relating to the quality of materials used for the project, including the sampling plans and test results of the materials. In a non-statistical sample of 17 projects reviewed from a population of 162 projects receiving final acceptance in fiscal year 2020, DOTD did not ensure the Summary of Samples and Test Results Form was completed within 90 days of the project?s final acceptance for 12 (71%) of the projects tested. ? For seven (41%) of these projects, the form was completed untimely, ranging from 108 to 360 days after final acceptance. ? For five (29%) of these projects, the form was not completed as of December 2020, with final acceptance dates in October 2019, December 2019, January 2020, and February 2020. In addition, there were two individually important projects reviewed where the Summary of Samples and Test Results Form was completed 361 days after final acceptance for one project, while the form was not completed as of December 2020 for the other project which had final acceptance in July 2019. Criteria: 23 CFR 637.205(a) requires that state transportation departments develop a quality assurance program which will assure that the materials and workmanship incorporated into each federal-aid highway construction project are in conformity with the requirements of the approved plans and specifications. Cause: DOTD did not ensure that the district engineers approved and submitted the Summary of Samples and Test Results Form to DOTD Headquarters in a timely manner. Effect: Untimely completion of the Summary of Samples and Test Results Form delays validation that the sampling and testing results were in accordance with DOTD?s quality assurance program. The absence of such documentation could result in a lack of support that the quality of materials and workmanship used met the requirements for a federally funded project. Recommendation: DOTD should continue tracking projects receiving final acceptance and emphasize the importance of timely submittal of the Summary of Samples and Test Results Form to district engineers. In addition, DOTD may consider alternative methods for district engineers to document their review and approval of the sampling and testing results. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-126).

2020-018 ? Noncompliance with Coronavirus Relief Fund Requirements Award Year: 2020 Award Number: Not Applicable Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Public Safety and Corrections, Corrections Services (DOC) received reimbursement from the CRF for expenditures at Louisiana State Penitentiary (LSP), Elayn Hunt Correctional Center (EHCC), and Adult Probation and Parole (P&P) facilities that did not comply with program requirements or were inadequately supported resulting in $1,648,025 total questioned costs. A review of vendor payments selected from LSP, EHCC, and P&P reimbursements for non-payroll expenditures in fiscal year 2020 disclosed the following: ? 99% of the total payments tested, including payments for Hepatitis C medication, upkeep for weed eaters, lawn mowers, and tractors, various auto repairs, horse feed, chairs re-upholstered, and shredders, did not have documentation to support that the expenditure was incurred due to public health emergency with respect to COVID-19 and not accounted for in the state budget most recently approved as of March 27, 2020, as required by CRF and DOA guidelines, resulting in questioned costs, totaling $1,648,025, as noted in the table below. See Schedule of Findings and Questioned Costs for chart/table ? 6% of the total payments tested relate to expenditures incurred prior to the CRF period of performance that began March 1, 2020. ? There was no evidence of review or approval of the reimbursement request by someone other than the employee preparing and submitting the request to the DOA. Criteria: The CARES Act, as amended, was enacted on March 27, 2020, and requires that CRF shall be (1) used for necessary expenditures incurred due to the public health emergency with respect to COVID-19; (2) not accounted for in the state budget most recently approved as of March 27, 2020; and (3) incurred during the period that begins March 1, 2020, and ends on December 31, 2021. The U.S. Department of the Treasury (Treasury) issued additional guidance and Frequently Asked Questions (FAQ) documents to further clarify how the CRF monies can be used. The Treasury guidance, dated April 22, 2020, included the following as an example of an allowable use of CRF: ?COVID-19 related expenses of maintaining state prisons and county jails, including as it relates to sanitation and improvement of social distancing measures, to enable compliance with COVID-19 public health precautions?. Additionally, the Office of the Commissioner, DOA memorandum to state agencies, dated March 10, 2020, requires agencies to track all expenditures relating to COVID-19, clearly mark invoices `Related to the Coronavirus COVID-19? and, if necessary, have a brief explanation of why it was necessary to incur the expenditure. Cause: Management did not have an adequate process in place to review the expenditures to determine they met the federal guidelines and to maintain the required documentation prior to submitting them for reimbursement. In addition, management included payments in the reimbursement request based on the date of the payment and not the date the expense was incurred. Effect: These exceptions resulted in total questioned costs of $1,648,025. Recommendation: Management should ensure that sufficient supporting documentation is available to indicate that each reimbursed expenditure is COVID-19 related, reimbursement requests only include expenses incurred within the period of performance, and reimbursement requests are reviewed and approved by someone other than the preparer. Management?s Response and Corrective Action Plan: Management did not concur with the finding and provided that the non-payroll expenditures were COVID-related because the costs relate to maintaining state prisons and additional eligible expenditures have not yet been reimbursed by CRF that could ?serve to replace any questionable costs? including expenditures determined to be purchased prior to March 1, 2020. Management also noted that it has strictly adhered to any and all guidance provided by the DOA (B-5). Auditor?s Additional Comments: Management?s response states that DOC has additional eligible expenditures that have not been reimbursed and could ?serve to replace any questionable costs?. These expenditures are not relevant to the scope of our audit work and should instead be presented to the federal oversight agency during audit resolution. In addition, management?s response refers to the Treasury guidance that provided an administrative allowance for states to presume that public health and public safety employees were substantially dedicated to mitigating or responding to the COVID-19 public health emergency and therefore, the payroll costs for those employees would be eligible uses of CRF funds. The Treasury guidance, however, does not afford that same administrative allowance to other types of expenditures. Therefore, we disagree with management?s rationale that ?given the presumption that public safety and public health employees? daily work activities are substantially dedicated to mitigating and responding to COVID-19, it was reasonable? for DOA to conclude that the costs of maintaining and operating prisons and youth facilities are eligible for CRF reimbursement.? As explained above, DOC did not have documentation to support that the non-payroll expenditures tested were COVID-19 related.

2020-019 ? Inadequate Controls over Certain Coronavirus Relief Fund Transactions Award Year: 2020 Award Number: Not Applicable Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2020, DOA did not thoroughly review certain state agency expenditures prior to approving reimbursement using CRF monies. The Louisiana Legislature appropriated a portion of the CRF monies received by the state of Louisiana to be used for the expenditures of state agencies resulting from the public health emergency with respect to COVID-19. DOA then established a process for state agencies to submit requests for reimbursement of allowable expenditures already incurred to be covered using CRF dollars. DOA was responsible for reviewing and approving these expenditures for CRF funding, to ensure they were for COVID-19 related expenditures. In addition, DOA was responsible for maintaining the support reviewed in approving the expenditures. Louisiana reported CRF expenditures totaling $217,118,448 on its fiscal year 2020 SEFA. Included in the $217.1 million were CRF reimbursements of certain non-payroll expenditures for DOC totaling $7,761,339, or 3.6% of the total. Criteria: Section 601(d) of the Social Security Act, as added by the CARES Act enacted on March 27, 2020, and as amended requires that CRF shall be used for (1) necessary expenditures incurred due to the public health emergency with respect to COVID-19; (2) were not accounted for in the state budget most recently approved as of March 27, 2020; and (3) were incurred during the period that begins March 1, 2020, and ends on December 31, 2021. The Treasury issued additional guidance and FAQ documents to further clarify how the CRF monies can be used. Treasury guidance dated April 22, 2020, included the following as an example of an allowable use of CRF: ?COVID-19 related expenses of maintaining state prisons and county jails, including as it relates to sanitation and improvement of social distancing measures, to enable compliance with COVID-19 public health precautions.? Cause: DOA decided that 100 percent of the non-payroll expenditures DOC submitted would be considered allowable for CRF funding as long as the costs were incurred during the allowed period and, therefore, did not require DOC to submit support that each expenditure incurred was a COVID-19-related expenditure. As a result, DOA approved the expenditures for CRF funding based on its review of system reports and other documentation evidencing payment; but the documentation reviewed did not identify the purpose of each expenditure to support the determination that it was incurred due to COVID-19. DOA represented this decision was made based on Treasury guidance dated April 22, 2020, the Treasury FAQ document dated May 4, 2020, and other information obtained verbally from DOC management. Effect: Not reviewing and maintaining sufficient detail to support that each expenditure reimbursed with CRF funds was incurred due to COVID-19 increases the risk that CRF monies were used for unallowed purposes potentially leading to questioned and/or disallowed costs. Recommendation: DOA management should ensure that DOC review previously approved reimbursements to ensure sufficient support is available to indicate that each approved expenditure was COVID-19 related, and should ensure that sufficient supporting documentation is submitted and maintained for any future requests for reimbursement of expenditures using CRF funds as evidence of compliance with Treasury guidance and FAQs. Management?s Response and Corrective Action Plan: DOA management did not concur with the finding and noted that the finding incorrectly states ?100 percent of non-payroll expenditures DOC submitted would be allowable.? Management contended that there was a complete review of documentation submitted and ?the reports submitted by DOC provided enough evidence to prove the expenditures were operating costs which were pre-determined to be eligible.? Management also contended that it was reasonable, given the administrative accommodation provided by the Treasury allowing all payroll costs for public safety employees, to consider the costs of maintaining and operating prisons as eligible CRF expenditures. DOA management further stated that ?the eligibility of the expenditures questioned by LLA is now irrelevant? since DOA is supplementing the initial state entity allocations with additional eligible expenditures by ?replacing reimbursed operating costs with eligible payroll expenditures? (B-15). Auditor?s Additional Comments: We would like to clarify that the finding accurately states, ?DOA decided that 100 percent of the non-payroll expenditures DOC submitted would be considered allowable for CRF funding as long as the costs were incurred during the allowed period, and therefore, did not require DOC to submit support that each expenditure incurred was a COVID-19 related expenditure.? In our judgement, it was not reasonable to pre-determine that all DOC operating expenditures incurred during the allowed period would be allowable, and therefore consider this to be a flaw in the design of the established controls. DOA?s response refers to the Treasury guidance that provided an administrative allowance for states to presume that public health and public safety employees were substantially dedicated to mitigating or responding to the COVID-19 public health emergency and therefore, the payroll costs for those employees would be eligible uses of CRF funds. This administrative allowance effectively reduced the documentation burden for those payroll costs in not requiring the states to track and document time spent by those employees related to COVID-19. The Treasury guidance, however, does not afford that same administrative allowance to other types of expenditures. Therefore, we disagree with DOA?s rationale that ?given the presumption that public safety and public health employees? daily work activities are substantially dedicated to mitigating and responding to COVID-19, it was reasonable?to conclude that the costs of maintaining and operating prisons and youth facilities are eligible for CRF reimbursement.? In addition, DOA?s response states that ?the eligibility of the expenditures questioned by LLA is now irrelevant? since DOA is supplementing the initial state entity allocations with additional eligible expenditures by ?replacing reimbursed operating costs with eligible payroll expenditures.? We would like to clarify that this finding only addresses the identified control deficiency and does not report questioned costs. Also, any additional expenditures that DOA may have identified as allowable to replace the previously approved operating costs are not relevant to the scope of our audit work and should instead be presented to the federal oversight agency during audit resolution.

2020-020 - Control Weakness over and Noncompliance with Coronavirus Relief Fund Award Year: 2020 Award Number: Not Applicable Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Public Safety and Corrections ? Youth Services ? Office of Juvenile Justice (OJJ) received reimbursement for expenditures that were unallowable and outside the period of performance under the CRF, per federal program rules and guidance. A review of 100% of non-payroll expenditures paid with the CRF, totaling $5,926,871, disclosed the following: ? For residential facilities caring for juveniles in OJJ?s custody, $363,183 of the $3,789,912 contract costs paid with CRF funds were also reimbursed by Foster Care federal funds, which is not allowable. The $363,183 payments are considered questioned costs. ? One residential facility payment of $8,385, not associated with a contract, was for dates of service in January 2020, which is outside of the period of performance for CRF and is considered questioned cost. In addition to the non-payroll testing above, auditors reviewed payroll expenditures from March 1, 2020, through May 31, 2020, included on the March 2020 and June 2020 quarterly administrative invoices. Auditors determined that a percentage of OJJ salary and benefit costs were paid by both CRF and Foster Care federal funds totaling $247,658, which are considered questioned costs. Criteria: The CARES Act, as amended, was enacted on March 27, 2020, and requires that CRF shall be used for (1) necessary expenditures incurred due to the public health emergency with respect to COVID-19; (2) were not accounted for in the state budget most recently approved as of March 27, 2020; and (3) were incurred during the period that begins March 1, 2020, and ends on December 31, 2021. Treasury issued additional guidance and FAQ documents to further clarify how the CRF monies can be used. Per Treasury guidance dated April 22, 2020, ineligible expenditures of payments from the CRF include expenditures that have been or will be reimbursed under any federal program. Cause: These conditions occurred due to weakness in OJJ?s control procedures that allowed federal funds to be used in noncompliance with federal requirements. Effect: Failure to comply with CRF program rules and guidance resulted in total questioned costs of $619,226. Recommendation: OJJ should ensure that reimbursements received under the CRF are not reimbursed from other federal programs and the expenditures were incurred within the period of performance. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-71).

2020-021 - Disbursement of CARES Act Funds to Ineligible Students Award Year: 2020 Award Number: P425E201230 Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Baton Rouge Community College (BRCC) incorrectly disbursed funds totaling $35,979 to 41 students during the spring semester who were officially withdrawn from all courses prior to March 13, 2020. Criteria: The CARES Act section 18004(c) states institutions of higher education shall provide emergency financial aid grants to students for expenses related to the disruption of campus operations due to coronavirus. Proclamation 9994 of March 13, 2020, ?Declaring a National Emergency Concerning the Novel Coronavirus Disease (COVID-19) Outbreak,? Federal Register, Vol. 85, No. 53 at 15337-38 was the official declaration of the President that the COVID-19 outbreak in the United States constituted a national emergency. As a result, and as further confirmed by correspondence with the U.S. Department of Education (USDOE), a student who withdrew from an institution prior to March 13, 2020, was not eligible to receive an emergency financial aid grant. Cause: BRCC considered students with active enrollment in a Title IV eligible program at any time during the period of March 1, 2020, to March 31, 2020, as meeting the eligibility requirements. Also, BRCC considered March 1, 2020 as the beginning of the national emergency. Effect: Disbursements to ineligible students may impact the formula calculation used to distribute funds to eligible students, and BRCC could be liable for the repayment of improper disbursements if disallowed by the federal grantor. Recommendation: BRCC should work with the grantor agency and legal counsel, as applicable, to determine the proper resolution of this issue. Management?s Response and Corrective Action Plan: Management did not concur with the finding, explaining in its response that, ??the College acted in good faith when disbursing the funds to students using the only definitive guidance at the time, which was the March 13, 2020, federal proclamation that specifically identified March 1, 2020, as the effective date of the national emergency.? Management further stated, ??the margin of error (1%) and the impact on eligible students were not statistically significant. Therefore, BRCC management deems this discrepancy more deserving of an audit recommendation, not an audit finding of non-compliance for the College? (B-2). Auditor?s Additional Comments: 2 CFR 200.516 requires the auditor to report findings for known questioned costs exceeding $25,000. When presented with BRCC?s explanation for why this occurred, we did reach out to the USDOE, Higher Education Emergency Relief Fund (HEERF) team, to explain BRCC?s rationale that the President's Proclamation, although dated March 13, 2020, listed an effective date of March 1, 2020, and seek clarification; however, the HEERF team responded clearly that ?...a student may not receive CARES funds if he/she withdrew from an institution before March 13, 2020.? As a result of this communication, we are required to question the applicable costs and report this finding.

2020-022 - Inadequate Controls over Return of Title IV Funds Award Years: 2019, 2020 Award Numbers: P063P185473, P063P195473, P268K195473, P268K205473 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: BRCC did not have adequate controls in place to ensure that returns of Title IV funds were accurately calculated and timely returned to the USDOE as required by federal regulations. In a non-statistical sample for the Summer 2019 semester of three students from a population of 483 students who were evaluated by BRCC for return of Title IV funds, one (33%) return calculation was inaccurate, resulting in $60 being returned improperly to the USDOE. Also, one (50%) of two required returns were not returned to the USDOE within 45 days of determining the student?s withdrawal dates as required by federal regulations. The late return was 18 days after the required 45-day period. In a non-statistical sample for the Fall 2019 semester of 14 students from a population of 2,520 students who were evaluated by BRCC for return of Title IV funds, two (14%) return calculations were inaccurate, resulting in $570 being returned improperly to the USDOE. Also, eight (80%) of 10 required returns were not returned to the USDOE within 45 days of determining the student?s withdrawal dates as required by federal regulations. The late returns ranged from three to four days after the required 45-day period. In a non-statistical sample for the Spring 2020 semester of 23 students from a population of 3,268 students who were evaluated by BRCC for return of Title IV funds, six (32%) return calculations were inaccurate, resulting in $128 being returned improperly to the USDOE and $135 owed back to the USDOE. Also, 16 (84%) of 19 required returns were not returned to the USDOE within 45 days of determining the student?s withdrawal dates as required by federal regulations. The late returns ranged from 31 to 32 days after the required 45-day period. In a separate test of tuition and fees, two return calculations were inaccurate for the Spring 2020 semester, resulting in $54 being returned improperly to the USDOE and $14 owed back to the USDOE. In a separate test of 15 withdrawals for the Spring semester relating to a qualifying emergency, seven (47%) student accounts did not receive the waiver as required by federal regulations, resulting in $6,826 being returned improperly to the USDOE and billed to the applicable students. Five (72%) of the seven students initially received waivers; however, the students accounts were not locked and the funds were returned during a batch process in error. Criteria: 34 CFR 668.22(a)(1) requires the institution to determine the amount of Title IV funds that the student earned as of the student?s withdrawal date. 34 CFR 668.22(j) requires the institution to return unearned Title IV funds within 45 days of the determination date of withdrawal. 34 CFR 668.22(f) defines how the percentage of the period of enrollment completed is calculated, including the total number of days in the period of enrollment, except scheduled breaks of at least five consecutive days are excluded from the total number. Section 3508 of the CARES Act directs the Secretary to waive the statutory requirement for institutions to return Title IV funds as the result of student withdrawals related to a qualifying emergency for the spring semester. Cause: Management noted the returns were untimely for the Summer 2019 and Fall 2019 semesters because the returns were held for processing in a larger batch, and that returns were untimely for the Spring 2020 semester because additional time was needed for management to evaluate the new federal guidance issued as the result of the coronavirus pandemic. Inaccurate return calculations were the result of the total number of days in the enrollment period and scheduled breaks incorrectly entered in the Banner system. The incorrect application of waivers to student accounts for the Spring 2020 semester was the result of oversight and erroneous adjustments to the student accounts. Effect: Failure to timely and accurately perform return of funds calculations and remit the related funds to the USDOE results in noncompliance with federal regulations and can result in improper billings to students and/or a loss of funds by BRCC. Recommendation: Management should strengthen controls to ensure any unearned funds by withdrawn students are accurately calculated by ensuring the total number of days in the enrollment period and scheduled breaks are correct in the Banner system; returns to the USDOE are completed within the required timeframes; and waivers as the result of student withdrawals related to a qualifying emergency for the Spring 2020 semester are properly applied to the student accounts. Management should adjust all applicable student accounts in the Banner system for the inaccurate returns and unapplied waivers. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-4).

2020-023 - Control Weakness over and Noncompliance with Return of Title IV Funds Requirements Award Year: 2020 Award Numbers: P063P192530, P268K202530 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Delgado Community College (Delgado) did not have adequate controls in place to ensure Title IV funds were calculated correctly and timely returned to the USDOE as required per federal regulations. In a non-statistical sample of 29 students from a population of 878 students totaling $2,948,356, who either officially or unofficially withdrew from the institution during the Fall 2019 semester, two (7%) students had errors in the return of Title IV funds calculations totaling $1,270. Criteria: 34 CFR 688.22(a)(1) requires the institution to determine the amount of Title IV funds that the student earned as of the student?s withdrawal date. 34 CFR 668.22(e)(4) requires the institution to calculate the amount of unearned Title IV assistance to be returned. 34 CFR 668.22(j) requires the institution to return program funds within 45 days of the determination date of withdrawal, and to determine the date of withdrawal within 30 days after the period of enrollment. Cause: Delgado did not have adequate procedures in place to properly calculate the amount of unearned funds to be returned and to ensure Title IV funds are timely returned to the USDOE. Effect: Failure to perform the return of Title IV funds calculations correctly resulted in noncompliance with federal regulations. Audit procedures performed identified $1,270 that Delgado did not return to the USDOE, which are considered questioned costs. Recommendation: Delgado should strengthen controls to ensure that all return of Title IV funds calculations are performed accurately and funds are timely returned to the USDOE. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-8). Auditor?s Additional Comments: In Delgado?s response, management noted that the error rate is only .02% of the entire population of students who either officially or unofficially withdrew from the institution during the Fall 2019 semester. While the audit procedures resulted in a 7% error rate in the sample tested, .02% is not an appropriate depiction of the possible error rate contained in the population since the projected error rate of the population would remain 7%. The correct calculation would be to multiply the 7% error rate by the total population of 878, which projects to a possible total of 61 errors.

2020-024 - Improper Disbursements to Students Award Year: 2020 Award Number: PE425E201641 Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Delgado disbursed funds totaling $57,284 from the HEERF - Student Aid Portion during the Spring 2020 semester to 79 ineligible students who were officially withdrawn from all courses prior to March 13, 2020. A total of 7,799 students at Delgado received this funding; therefore, approximately 1% of these students were ineligible. Criteria: CARES Act section 18004(c) states institutions of higher education shall provide emergency financial aid grants to students for expenses related to the disruption of campus operations due to coronavirus. Proclamation 9994 of March 13, 2020, ?Declaring a National Emergency Concerning the COVID-19 Outbreak,? was the official declaration of the President that the COVID-19 outbreak in the United States constituted a national emergency. As a result, and as further confirmed by correspondence with the USDOE, a student who withdrew from an institution prior to March 13, 2020, was not eligible to receive an emergency financial aid grant. Cause: Delgado considered students with active enrollment in a Title IV eligible program at any time during the period of March 1, 2020, to March 31, 2020, as meeting the eligibility requirements. Effect: Disbursements to ineligible students are considered questioned costs and may impact the formula calculation used to distribute funds to eligible students. Delgado could be liable for repayment of the improper disbursements if disallowed by the federal grantor. Recommendation: Delgado should work with the grantor agency and legal counsel, as applicable, to determine the proper resolution of this issue. Management?s Response and Corrective Action Plan: Management did not concur with the finding, explaining in its response that, ??the College acted in good faith when disbursing the funds to students using the only definitive guidance at the time, which was the March 13, 2020, federal proclamation that specifically identified March 1, 2020, as the effective date of the national emergency.? Management further stated, ??the margin of error (1%) and the impact on eligible students were not statistically significant. Therefore, Delgado management deems this discrepancy more deserving of an audit recommendation, not an audit finding of non-compliance for the College.? In addition, management states that, ??the statement of effect that Delgado could be liable for repayment of the improper disbursements if disallowed by the federal grantor, should be instead a general recommendation as this could not be the effect for this particular funding. The USDOE?s clarification response to the LLA on March 9, 2021, which was shared with the College on March 18, 2021, specifically stated that an institution that has awarded funds to a student who withdrew after March 13, 2020, does not have to recoup the funds awarded? (B-9). Auditor?s Additional Comments: 2 CFR 200.516 requires the auditor to report findings for known questioned costs exceeding $25,000. When presented with Delgado?s explanation for why this occurred, we did reach out to the USDOE, HEERF team, to explain Delgado?s rationale that the President's Proclamation, although dated March 13, 2020, listed an effective date of March 1, 2020, and seek clarification. However, the HEERF team responded clearly that ?...a student may not receive CARES funds if he/she withdrew from an institution before March 13, 2020.? As a result of this communication, we are required to question the applicable costs and report this finding. Finally, while we concur that the guidance received from the HEERF team notes that no recoupment of funds would occur for students who withdrew after March 13, 2020, the payments to ineligible students noted in the finding relate to students who withdrew prior to March 13, 2020. If these questioned costs are disallowed by the federal grantor, those funds may be recouped by the federal grantor in accordance with 2 CFR 200.339.

2020-025 - Inadequate Controls over Recording Class Attendance for Distance Education Award Year: 2020 Award Numbers: P063P192530, P268K202530 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Delgado did not have adequate controls in place to ensure class attendance was properly recorded by instructors for students enrolled in online (distance education) courses and identify the students who withdrew (officially or unofficially) in accordance with established policies. In a non-statistical sample of 40 students from a population of 4,978 students who were enrolled in distance education, Delgado did not properly record attendance for four (10%) students that received Title IV funding. Criteria: In accordance with Delgado?s attendance policy, all online courses are required to have attendance taken, with a minimal participation requirement of two online assignments or activities (may include tests, quizzes, assessments) submitted by the student each week throughout the semester. The policy further notes, by the official fourteenth class day (seventh class day for summer session or atypical sessions), all instructors are required to drop any student who has never attended the class or participated in an online course. By midterm, instructors are required to assign a FN (failed for nonattendance) grade to each student for whom the instructor identifies as not meeting the requirements for sufficient participation at midterm to be successful in the course. If a student receives FNs in all enrolled classes at midterm, the student will be unofficially withdrawn from the college by the college registrar. 34 CFR 668.22(a)(1) notes that when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student's withdrawal date in accordance with 34 CFR 668.22(e). Per 34 CFR 668.22(c)(3) an institution that is not required to take attendance may use as the student's withdrawal date a student's last date of attendance at an academically-related activity provided that the institution documents that the activity is academically related and documents the student?s attendance at the activity. 34 CFR 668.22(e)(4) requires the institution to calculate the amount of unearned Title IV assistance to be returned. 34 CFR 668.22(j) requires the institution to return program funds within 45 days of the determination date of withdrawal and to determine the date of withdrawal within 30 days after the period of enrollment. Cause: The information in Delgado?s system for these four students indicated a lack of attendance based on their logged participation or academic activity ceasing before the specified date. However, these students remained on the class rosters. These students should have been dropped from the courses in accordance with Delgado?s attendance policy. Effect: This resulted in Delgado either not performing or incorrectly performing the return of Title IV calculations and these students remaining eligible to receive student financial aid. Failure to properly document attendance and timely identify students who may require a return of Title IV funds resulted in noncompliance with federal regulations. As a result, Delgado did not return $3,299 of Title IV funds to the USDOE, which are considered questioned costs. Recommendation: Delgado should ensure that instructors document the attendance requirement of assigning two online assignments or activities submitted by the student each week throughout the semester. Delgado also should strengthen procedures over distance education to ensure all students requiring a return of Title IV funds calculation are identified and return of funds procedures are performed timely and accurately. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-11).

2020-026 - Noncompliance and Control Weakness Related to Student Financial Assistance Borrower Data Reconciliations Award Year: 2020 Award Number: P268K202530 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Delgado did not properly perform monthly reconciliations of the School Account Statement (SAS) data files to the institution?s financial records. Criteria: 34 CFR 685.300(b)(5) requires that schools must, on a monthly basis, reconcile institutional records with Direct Loan funds received and Direct Loan disbursement records submitted to and accepted by the USDOE. 2 CFR 200.303 require that non-federal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Cause: Each month, the USDOE?s Common Origination and Disbursement (COD) system provides the institution the SAS data file, which should be reconciled back to the Daily G5 Draw Down reports and the institution?s financial records to ensure the institution has transmitted accurate and complete student data to the COD system for all Federal Direct Student Loan borrowers in accordance with federal requirements. While Delgado performs a reconciliation of loan amounts drawn from G5 to the loan amounts disbursed to students, Delgado?s reconciliation process did not incorporate use of the SAS data files as required by federal regulations to ensure that loan information submitted to the USDOE for Direct Student Loan borrowers is complete. Effect: Failure to establish procedures to perform the SAS data file monthly reconciliation places Delgado in noncompliance with federal regulations and could result in Delgado reporting inaccurate information to the COD system. Recommendation: Management should establish procedures to ensure Delgado properly performs monthly reconciliations of the SAS data files to the institution?s financial records. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-12).

2020-027 - Noncompliance with Student Financial Assistance Enrollment Reporting Requirements Award Year: 2020 Award Numbers: P063P192530, P268K202530 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Delgado did not ensure changes in enrollment status for students who received Federal Pell Grants and Federal Direct Student Loans were accurately and timely reported to the National Student Loan Data System (NSLDS) as required by federal regulations. From a population of 3,440 changes in student enrollment status occurring during fiscal year 2020, a non-statistical sample of 40 were tested and revealed two (5%) of these student enrollment status changes were not reported or were inaccurately reported to the NSLDS. Criteria: 34 CFR 685.309 requires a participating school to notify the USDOE within 30 days after the school discovers that a loan under Title IV was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended. Cause: Delgado did not have sufficient internal controls to accurately report changes in student enrollment status to its third-party servicer, the National Student Clearinghouse (Clearinghouse). In addition, the Clearinghouse failed to report changes to the NSLDS and Delgado did not monitor the Clearinghouse to ensure that all enrollment status changes submitted to the Clearinghouse were accurately reported to the NSLDS. Effect: Inaccurate reporting of changes in enrollment status could impact the student?s Pell grant or student loan eligibility and result in either the advance or delay of a student?s grace period or obligation to begin or resume making scheduled loan payments, which could impair the federal government?s ability to recoup loan funds from the student. Recommendation: Management should identify all changes in enrollment status for students receiving Federal Pell Grants and Federal Direct Student Loan funds and ensure that the Clearinghouse accurately and timely reports this information to the NSLDS. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-13). Auditor?s Additional Comments: In Delgado?s response, management concurred that one student?s graduation status was not updated accurately in NSLDS, and another student?s withdrawn status for Spring 2020 was not accurately reported to NSLDS. However, management noted that the error is only 5% of those sampled and .06% of the total population of changes in student enrollment status occurring during fiscal year 2020, which management deems is not statistically significant. While the audit procedures did result in a 5% error rate in the sample tested, .06% is not an appropriate depiction of the possible error rate contained in the population since the projected error rate of the population would remain 5%. The correct calculation would be to multiply the 5% error rate by the total population of 3,440, which projects to a possible total of 172 errors.

2020-028 - Noncompliance with Gramm-Leach-Bliley Act - Student Information Security Requirements Award Year: 2020 Award Numbers: P063P191514, P268K201514 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LSU A&M did not have a formal documented risk assessment that clearly addressed the following areas required by the Gramm-Leach-Bliley Act standards for safeguarding student information, nor did LSU A&M have a documented program to implement safeguards to address identified risks: ? Employee training and management; ? Information systems including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing and responding to attacks, intrusions, or other systems failures. LSU A&M provided two risk assessments; while they appeared to cover elements of the required areas, the risk assessments were not designed specific to the Gramm-Leach-Bliley Act. Furthermore, LSU A&M does have in place information security required employee training, password and access policies and procedures, security controls, and a documented disaster recovery plan to help safeguard student information. While these and other implemented safeguards at LSU A&M address some of the identified risks in these assessments, LSU A&M did not design and implement safeguards for all risks and has not documented which risks these safeguards mitigate. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program, (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: LSU A&M did not perform a formal risk assessment including safeguards to address identified risks. Effect: Failure to meet the requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information and results in noncompliance. Recommendation: Management should develop, implement, and maintain information security programs that include a formal documented risk assessment specific to the Gramm-Leach-Bliley Act and implement safeguards to control the risks identified in regards to student information. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-74).

2020-029 - Unallowed CARES Act Payroll Expenditures Award Year: 2020 Award Number: P425F201489 Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: South Louisiana Community College (SLCC) incorrectly used federal funds totaling $41,666 to pay salaries and benefits to its executive team. Criteria: Per SLCC?s Funding Certification and Agreement for the Institutional Portion of the HEERF, the USDOE would not consider senior administrator and/or executive salaries and benefits to be related to significant changes to the delivery of instruction due to the coronavirus, and therefore would not view them as allowable expenditures. Cause: SLCC included the executive team in the payroll extract used for determining the COVID-19 related salary expenditures. Management represented that the issue was identified on February 2, 2021, and plans to reduce the next reimbursement request to remedy it. Effect: Using HEERF funds for unallowed expenditures places SLCC in noncompliance with the program and could cause SLCC to be liable for the repayment of funds. Recommendation: SLCC should immediately return unallowed costs to the USDOE and work with the grantor agency to determine if any other expenditures were claimed that would be considered 'senior administrator or executive' and, if any, the proper resolution of those expenditures. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and noted that corrective action is not necessary since the ineligible expenses have been returned to the USDOE (B-98). Auditor?s Additional Comments: Management indicated that the federal funds were not used to pay salaries and benefits. On September 25, 2020, SLCC used ineligible executive salaries as supporting expenses to drawdown federal funds. On April 13, 2021, these federal funds were returned to the USDOE through a credit to a federal drawdown.

2020-030 - Unallowed Disbursement of CARES Act Funds to Students Award Year: 2020 Award Number: P425E201201 Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SLCC incorrectly disbursed funds totaling $31,184 to 40 students during the spring semester who were officially withdrawn from all courses prior to March 13, 2020. Criteria: Per the CARES Act section 18004(c), emergency financial aid shall be granted to students for ?expenses related to the disruption of campus operations due to coronavirus.? Furthermore, guidance from the USDOE establishes March 13th, 2020, the date of Proclamation 9994, ?Declaring a National Emergency Concerning the Novel Coronavirus Disease (COVID-19) Outbreak,? as the earliest date on which students could have incurred expenses related to the disruption of campus operations due to coronavirus. Cause: SLCC considered students with active enrollment in a Title IV eligible program at any time during the period of March 1, 2020 to March 31, 2020 to be eligible. Effect: Unallowed disbursements to students may impact the formula calculation used to distribute funds to other students, and SLCC could be liable for the repayment of improper disbursements if disallowed by the federal grantor. Recommendation: SLCC should work with the grantor agency and legal counsel, as applicable, to determine the proper resolution of this issue. Management?s Response and Corrective Action Plan: Management did not concur with the finding, explaining in its response that, ??the College acted in good faith when disbursing the funds to students using the only definitive guidance at the time, which was the March 13, 2020, federal proclamation that specifically identified March 1, 2020, as the effective date of the national emergency.? Management further stated, ??the margin of error (1.1%) and the impact on eligible students were not statistically significant. Therefore, SLCC management deems this discrepancy more deserving of an audit recommendation, not an audit finding of non-compliance for the College.? In addition, management states that, ??the statement of effect that the College could be liable for repayment of the improper disbursements if disallowed by the federal grantor, should be instead a general recommendation as this could not be the effect for this particular funding. The USDOE?s clarification response to the LLA on March 9, 2021, which was shared with the College on March 11, 2021, specifically stated that an institution that has awarded funds to a student who withdrew after March 13, 2020, does not have to recoup the funds awarded.? (B-99). Auditor?s Additional Comments: 2 CFR 200.516 requires the auditor to report findings for known questioned costs exceeding $25,000. When presented with SLCC?s explanation for why this occurred, we reached out to the USDOE, HEERF team, to explain SLCC?s rationale that the President's Proclamation, although dated March 13, 2020, listed an effective date of March 1, 2020, and seek clarification. However, the HEERF team responded clearly that ?...a student may not receive CARES funds if he/she withdrew from an institution before March 13, 2020.? As a result of this communication, we are required to question the applicable costs and report this finding. Finally, while we concur that the guidance received from the HEERF team notes that no recoupment of funds would occur for students who withdrew after March 13, 2020, the payments to ineligible students noted in the finding relate to students who withdrew prior to March 13, 2020. If these questioned costs are disallowed by the federal grantor, those funds may be recouped by the federal grantor in accordance with 2 CFR 200.339.

2020-031 - Overpayment of Student Financial Assistance Award Year: 2020 Award Numbers: P268K151524, P268K201524 Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2019-016) See Schedule of Findings and Questioned Costs for chart/table Condition: Southeastern Louisiana University (Southeastern) did not properly determine if students were eligible to receive student financial assistance, resulting in noncompliance with federal regulations. In the prior audit, which included students awarded through the Fall 2019 semester, we determined that Southeastern allowed students to borrow in excess of the aggregate loan limits for Federal Direct Loans. In the current-year audit, we identified six additional students who were allowed to borrow $14,754 in excess of the aggregate loan limits for Federal Direct Loans and were not corrected timely as follows: ? One student from the Summer 2015 semester totaling $677 ? Four students from the Fall 2019 semester totaling $13,577 ? One student from the Summer 2020 semester totaling $500 Criteria: 34 CFR 685.203 (d) and (e) sets the aggregate limits for subsidized loans ($23,000 ? undergraduate and $65,000 ? graduate or professional student) and the aggregate limits for unsubsidized loans (dependent students - $31,000 minus any Direct Subsidized Loan and Subsidized Federal Stafford Loan amounts; independent students or dependent with denied Parent Plus Loan - $57,500 minus any Direct Subsidized Loan and Subsidized Federal Stafford Loan amounts; graduate/professional students - $138,500 including loans for undergraduate studies minus any Direct Subsidized Loan and Subsidized Federal Stafford Loans amount). 34 CFR 668.32(g)(2) states a student is not eligible to receive funds under any of the Title IV student aid programs if the student has received Title IV loan funds in excess of applicable statutory loan limits. 34 CFR 668.35(d) specifies actions that a student who has inadvertently exceeded an annual or aggregate loan limit may take to regain Title IV eligibility by reaffirming the outstanding debt or by making satisfactory repayment arrangements. When reaffirming excess borrowing, an institution must determine that a borrower?s receipt of loan funds in excess of an annual or aggregate loan limit was inadvertent before the borrower may regain Title IV eligibility. Good internal controls require the university to review students? payment information to ensure that students will not exceed the annual or aggregate loan limits in determining if students are eligible for Federal Direct Loans, are not in default, and do not owe an overpayment on a Title IV grant or loan. Cause: Southeastern?s financial aid staff did not perform an adequate review to ensure that all students were eligible to receive student financial assistance. Effect: Failure to determine eligibility status prior to awarding loans or grants may result in noncompliance with federal regulations and increases the likelihood of disallowed federal funds that Southeastern may be required to return to the federal grantor. Recommendation: Southeastern should review the query that identifies students who may have exceeded or are close to exceeding the aggregate loan limits on a weekly basis to ensure that students are eligible for all financial assistance received. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-101).

2020-032 - Control Weakness over and Noncompliance with Higher Education Emergency Relief Fund Reporting Requirement Award Year: 2020 Award Number: P425E200926 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Southern University Baton Rouge (SUBR) did not ensure compliance with the public reporting requirement of the HEERF Student Aid Portion as established by the USDOE. SUBR did not publicly post the initial 30-day student aid award information on its website, which should have included amounts distributed to students from the date of the award, April 22, 2020, through May 22, 2020, totaling $3,654,200. SUBR did, however, post a 45-day student aid award report on its website July 22, 2020, with a cumulative total of $4,115,900. Criteria: Section 18004(e) of the CARES Act requires institutions to submit a report to the USDOE, at such time and in such manner as the USDOE may require, that describes the use of funds. Per the August 31, 2020, Federal Register, institutions are required to submit an initial report to the USDOE on their primary website 30 days from the date of its Certification and Agreement (award). It goes on to say institutions are encouraged to report as soon as possible, but no later than 30 days after the publication of this notice, or 30 days after the date the funds are awarded, whichever comes later. Cause: SUBR did not have processes in place to ensure the public posting of the initial 30-day Student Aid report as required by the USDOE. Effect: SUBR is in noncompliance with the 30-day reporting requirement as stated in the federal register. Recommendation: Management should strengthen its procedures over reporting of the HEERF Student Aid information to ensure compliance with all requirements. Management?s Response and Corrective Action Plan: Management did not concur with the finding stating that the USDOE?s May 6, 2020, Electronic Announcement was superseded by the August 31, 2020, Federal Register notice. SUBR interpreted this to revise the initial 30-day due date to September 30, 2020 (B-103). Auditor?s Additional Comments: LLA does not disagree with the due date of the 30-day reporting rather that the 30-day information was not explicitly presented on the website as required.

2020-033 - Control Weakness over and Noncompliance with Return of Title IV Funds Award Year: 2020 Award Numbers: P063P191525, P268K201525 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR did not have adequate controls in place to ensure that returns of Title IV funds were calculated and returned to the USDOE as required by federal regulations. In a non-statistical sample for the fall semester of 19 students from a population of 187 students who were evaluated for return of funds, five (26%) students were not identified by SUBR as having unofficially withdrawn, the required return of Title IV calculation for these students was not performed, and SUBR did not return $11,707 of Title IV funds to the USDOE. In a non-statistical sample for the spring semester of 18 students from a population of 176 students who were evaluated for return of funds, five (28%) students were not identified by SUBR as having unofficially withdrawn, and the required return of Title IV calculation for these students was not performed. Due to a waiver provided by the USDOE, as allowed by the CARES Act, SUBR was not required to return these funds to USDOE; therefore, no questioned costs are reported. As a part of audit procedures performed for another Student Financial Assistance (SFA) Cluster compliance requirement, the auditor recognized that one additional student was not identified by SUBR as having unofficially withdrawn during the spring semester, and the required return of Title IV calculation for this student was not performed. In addition, audit procedures revealed that SUBR used incorrect academic calendar dates in the Banner system which could affect the total number of enrollment period days in the return of Title IV calculations for the fall and spring semesters. For official withdrawals, the number of days used in the fall semester calculation was 131 rather than 110, and the number of days used in the spring semester calculation was 152 rather than 101. Criteria: 34 CFR 668.22(a)(1) requires the institution to determine the amount of Title IV funds that the student earned as of the student?s withdrawal date. 34 CFR 668.22(j) requires the institution to return program funds within 45 days of the determination date of withdrawal, and to determine the date of withdrawal for a student who withdraws without providing notification within 30 days after the period of enrollment. 34 CFR 668.22(f) defines how the percentage of the period of enrollment completed is calculated, including the total number of days in the period of enrollment. Furthermore, the SFA Handbook states the instructional time in an academic year should begin on the first day of classes and end on the last day of classes or examinations. 34 CFR 668.22(e)(4) requires the institution to calculate the amount of unearned Title IV assistance to be returned. Per Section 3508 of the CARES Act, a return of Title IV funds to the USDOE was not required for the spring semester for student withdrawals related to a qualifying emergency. However, institutions were still required to perform a return of Title IV calculation in order to determine the amount of Title IV funds that would otherwise have to be returned. Cause: SUBR did not have adequate procedures in place to identify students who unofficially withdrew, did not calculate the amount of unearned funds to be returned, and entered incorrect enrollment period dates into the Banner system. Effect: Failure to identify students who may require a return of funds and failure to perform the return of funds calculations timely resulted in noncompliance with federal regulations. In addition, using the incorrect total number of days in the return of funds calculation could result in less being returned to the USDOE than required. Audit procedures performed identified $11,707 that SUBR did not return to the USDOE, which is considered questioned cost. Recommendation: Management should strengthen controls to ensure that all students requiring a return of funds calculation are identified and return of funds procedures are performed timely and accurately. Additionally, management should ensure the total number of days in the period of enrollment is correct in the Banner system, recalculate the return of Title IV amounts, and return any additional funds to the USDOE, as applicable. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-106).

2020-034- Control Weakness over and Noncompliance with Student Financial Assistance Program Verification Regulations Award Year: 2020 Award Numbers: P063P191525, P268K201525 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR did not ensure compliance with SFA program regulations related to verification. In a non-statistical sample of 60 students from a population of 1,731 students who were selected for verification, our procedures revealed that for two (3%) of 60 students tested, SUBR was either unable to provide support or did not recalculate the Pell Grant award based on changes noted during verification and ensure those changes were submitted to the USDOE. Criteria: 34 CFR 668.57 requires that if an applicant is selected to be verified, an institution must obtain the specified documentation. 34 CFR 668.59(a) requires that if an applicant?s Free Application for Federal Student Aid (FAFSA) information changes as a result of verification, the applicant or the institution must submit any changes to the USDOE. 34 CFR 668.59(b)(1)(2)(iii) states that for the Pell Grant Program, if an applicant?s FAFSA information changes as a result of verification, an institution must recalculate the Pell Grant on the basis of the Expected Family Contribution and comply with overpayment regulations. Cause: SUBR failed to retain documentation and recalculate the award based on changes noted during the verification process. Effect: The weakness in internal controls resulted in noncompliance with SFA program verification requirements, and one student was over awarded by $1,300, which is considered questioned cost. Recommendation: Management should strengthen internal controls to ensure specified documentation is retained and awards are recalculated to comply with SFA federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-108).

2020-035- Control Weakness over and Noncompliance with Student Financial Assistance Reporting Requirements Award Year: 2020 Award Number: P268K201525 Compliance Requirement: Reporting Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR did not ensure compliance with SFA program regulations related to Direct Loan payment data reporting. In a non-statistical sample of 60 students from a population of 6,329 students who received SFA, our procedures revealed that SUBR had the following Direct Loan exceptions for 45 (75%) students tested, of which some students had more than one error: ? For 45 students, the academic calendar dates reported to the COD system did not agree with the first and last day of classes. ? For five students, the disbursement dates in the COD system did not agree to SUBR?s Banner system. ? For one student, the amount disbursed per the COD system for a transaction number did not agree to SUBR?s Banner system. Criteria: Per the SFA Handbook, for Direct Loans, a loan period certified for an academic year includes academic calendar dates beginning on the first day of classes and ending on the last day of classes or examinations. 34 CFR 685.301(a)(2) requires a school participating in the Direct Loan Program to ensure information it provides is complete and accurate including the borrower?s disbursement date and loan amount. Cause: SUBR did not implement adequate controls to ensure accurate academic calendar dates were reported to the COD system and that loan disbursement dates and amounts agreed between SUBR?s Banner system and the COD system. Effect: Failure to record and report accurate origination and disbursement data to the COD system results in noncompliance with federal regulations and could affect a borrower?s loan eligibility. Recommendation: Management should strengthen its internal controls over SFA data recording and reporting as well as make appropriate corrections to dates and amounts reported in the Banner and COD systems as needed. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-110).

2020-036 - Control Weakness over Student Financial Assistance Borrower Data Reconciliations Award Year: 2020 Award Number: P268K201525 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR did not properly reconcile the SAS data files to the institution?s financial records. Each month, the USDOE?s COD system provides the institution the SAS data file, which should reconcile back to the G5 system draw down reports and the institution?s financial records to ensure the institution has transmitted accurate and complete student data to the COD system for all Federal Direct Student Loan borrowers in accordance with federal requirements. In a non-statistical sample of two monthly reconciliations from a population of 12 months, our procedures revealed both reconciliations did not include a reconciliation of cash received from the G5 system to the COD system and reasons for differences in disbursement information were not documented. Criteria: 34 CFR 685.300(b)(5) requires that schools must, on a monthly basis, reconcile institutional records with Direct Loan funds received and Direct Loan disbursement records submitted to and accepted by the USDOE. Per the 2019-2020 Federal Student Aid Handbook (Vol. 4, Ch. 6), a school that participates in the Direct Loan Program is required monthly to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the COD system. Cause: SUBR did not have adequate controls in place to ensure adherence with federal regulations in its performance of monthly reconciliations of Direct Loan receipts and disbursements. Effect: Failure to set prescribed controls over the SAS data file monthly reconciliations could result in SUBR reporting inaccurate information to the COD system and place SUBR in noncompliance with borrower data transmission federal regulations. In addition, failure to reconcile to the G5 system could affect the overall cash management controls. Recommendation: Management should strengthen its controls over the monthly direct loan disbursement reconciliations to include reconciling to the G5 system and documenting the resolution of differences in disbursement information between SUBR and the COD system. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-112).

2020-037 - Noncompliance with Student Financial Assistance Disbursement Regulations Award Year: 2020 Award Numbers: P063P191525, P268K201525 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR did not ensure compliance with SFA program regulations related to Direct Loan disbursements and the Direct Loan Quality Assurance System. In a non-statistical sample of 60 students from a population of 6,329 students who attended SUBR or Southern University Law Center and received Pell Grant and/or Direct Loan funds, SUBR did not send the required Direct Loan disbursement letter notices to 54 (90%) of the students tested. In addition, SUBR was unable to provide documentation of its Direct Loan Quality Assurance System. Criteria: 34 CFR 668.165(a)(2) states an institution that credits a student ledger account with Direct Loan funds must notify the student or parent of the anticipated date and amount of the disbursement, the student's or parent's right to cancel all or a portion of that loan and have the loan proceeds returned to the USDOE, and the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or loan disbursement. 34 CFR 668.165(a)(3) requires the institution to provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student's ledger account. 34 CFR 685.300(b)(9) requires schools to implement a quality assurance system to ensure they are complying with program requirements and meeting program objectives. Cause: SUBR did not send disbursement notices due to a system process not being activated, which would have prompted the system to email the notices. In addition, SUBR did not document its Direct Loan Quality Assurance System. Effect: Failure to notify the students or parents results in noncompliance and increases the risk that loan disbursement cancellations will not be returned to the USDOE timely. Failure to implement a Direct Loan Quality Assurance System increases the risk of noncompliance and that SUBR will not meet program objectives. Recommendation: Management should implement procedures to ensure that students or parents are notified in accordance with SFA federal regulations and that the Direct Loan Quality Assurance System is documented and implemented. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-114).

2020-038 - Inaccurate Reporting of Student Enrollment Status Award Year: 2020 Award Numbers: P063P191525, P268K201525 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR and Southern University Law Center (SULC) did not accurately and timely report changes in enrollment status for students who received Federal Pell Grant funds and/or Federal Direct Student Loan funds to the NSLDS as required by federal regulations. In a non-statistical sample of 60 students tested for changes in enrollment status from a population of 1,003 students at SUBR in the fall and spring semesters and SULC in the fall semester, the following was identified for six (10%) SUBR students: ? One graduate student was incorrectly reported as withdrawn on the campus level. ? One graduate student was incorrectly reported as withdrawn on the program and campus levels. Although the correct information was reported to the Clearinghouse, it was not on NSLDS. ? One full-time student was incorrectly reported as graduated on the program and campus levels. ? One graduate student was not reported timely on NSLDS, although it was reported timely to the Clearinghouse. ? Two student?s withdrawn status was not reported timely. In a non-statistical sample of 12 students tested for changes in enrollment status from a population of 117 students at SULC in the spring semester, 12 (100%) students who had graduated were incorrectly reported as full-time or part-time on the program and campus levels. Criteria: 34 CFR 685.309 requires, unless it expects to submit its next updated enrollment report to the USDOE within the next 60 days, a school must notify the USDOE within 30 days after the school discovers that a loan under the Title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended. The USDOE Federal Student Aid Attachment to (GEN-12-06) Dear Colleague Letter, dated March 30, 2012, requires enrollment information entered into the NSLDS for Pell recipients to allow the USDOE to properly evaluate the program. The Pell Grant recipient enrollment reporting will be accomplished using the same process, data fields, and codes as is used for the NSLDS Enrollment Reporting for Title IV student loan recipients. The NSLDS Enrollment Reporting Guide, dated November 2019, states that schools using an Enrollment Reporting Servicer are still primarily responsible for submitting timely, accurate, and complete responses to Enrollment Reporting Roster files, and for reporting any changes in student enrollment status in a timely manner. Cause: SUBR and SULC did not have proper controls in place to ensure changes in enrollment status for students who received Federal Pell Grant funds and Federal Direct Student Loan funds were accurately and timely reported to the NSLDS. In addition, SUBR did not monitor its third-party servicer, the Clearinghouse, to ensure that all enrollment status changes submitted to the Clearinghouse were reported to the NSLDS. Effect: Inaccurate and untimely reporting of changes in enrollment status could impact the student?s Pell grant or student loan eligibility and result in either the advance or delay of a student?s grace period or obligation to begin or resume making scheduled loan payments, which could impair the federal government?s ability to recoup loan funds from the student and results in noncompliance with federal regulations. Recommendation: Management should strengthen its procedures over changes in enrollment status for students receiving Federal Pell Grant funds and Federal Direct Student Loan funds, report accurate and timely information to the NSLDS, and establish a monitoring system to ensure that the Clearinghouse accurately and timely reports this information to the NSLDS. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-116 and B-117).

2020-039 - Noncompliance with Gramm-Leach-Bliley Act ? Student Information Security Requirements Award Year: 2020 Award Numbers: P063P191525, P268K201525 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: SUBR and SULC did not have a documented risk assessment or related safeguards that address the minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding customer (student) information. In our review of SUBR and SULC?s information security programs for fiscal year 2020, they were unable to provide a documented risk assessment for the following required areas: ? Employee training and management ? there are information technology policies and practices that require employee training, but no documented risks or sufficiency of these safeguards. ? Information systems including network and software design, as well as information processing, storage, transmission and disposal ? there are Banner system policies and procedures, but no documented risks or sufficiency of these safeguards. ? Detecting, preventing and responding to attacks, intrusions, or other systems failures ? there is a documented disaster recovery plan and password policy, but no documented risks or sufficiency of these safeguards. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program; (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: Management did not perform a formal risk assessment including safeguards to address identified risks. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction or other compromise of customer (student) information and results in noncompliance. Recommendation: Management should develop, implement, and maintain information security programs including identifying risks for relevant areas of operation and design and implement safeguards to control the risks identified. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-118).

2020-040 - Changes in Enrollment Status Not Reported Award Years: 2019, 2020 Award Numbers: P063P191529, P268K201529 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The University of Louisiana at Lafayette (UL Lafayette) did not report changes in enrollment status to the NSLDS, as required by federal regulations, for students who received SFA funds and unofficially withdrew from the university or had a change of enrollment status due to registering for but never attending a class. Normally, at the end of a semester, the Financial Aid Office reviews students with a grade-point average (GPA) of 0 or who receive a grade of ?FN? ? never attended to identify students who unofficially withdrew or dropped below half-time enrollment. The Financial Aid Office manually updates students? status in the NSLDS. Criteria: 34 CFR 685.309 and 690.83 and the Dear Colleague Letter GEN 12-06 requires UL Lafayette to report the change in enrollment status for students who graduated, withdrew, never attended, or ceased to be enrolled on at least a half-time basis to the NSLDS within 60 days of knowledge of a student?s status change. Cause: The Financial Aid Office failed to update the NSLDS for students who unofficially withdrew from the university or dropped below half-time due to receiving a grade of ?FN? - never attended. Effect: Failure to report changes in enrollment status could impact the student?s financial aid eligibility and result in noncompliance with federal regulations. Recommendation: Management should strengthen controls to ensure all changes in enrollment status are reported to the NSLDS, as required by federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-128).

2020-041 - Control Weakness and Noncompliance over Return of Title IV Funds Award Years: 2019, 2020 Award Numbers: P063P191529, P268K201529 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: UL Lafayette did not have adequate controls in place to ensure that return of Title IV funds was accurately calculated and returned to the USDOE as required by federal regulations. In a non-statistical sample of 25 students from a population of 342 students who were evaluated for return of funds, 17 (68%) students had an incorrect withdrawal date used in the calculation for return of Title IV funds. The incorrect dates caused UL Lafayette to fail to remove $2,945 of Direct Loan funds from the students? accounts and return those funds to the USDOE for students enrolled in the Fall 2019 semester. UL Lafayette would have been required to return an additional $3,203, but a waiver provided by the USDOE, as allowed by the CARES Act, exempts UL Lafayette from having to return the funds for the Spring 2020 semester. Additionally, for one of the 17 students included above, UL Lafayette did not update the Pell award for a change in enrollment status. This resulted in an over award to the student of $544. Criteria: 34 CFR 668.22 requires the university to determine the amount of Title IV funds that the student earned as of the student?s withdrawal date. 34 CFR 668.22(j) requires the university to return program funds within 45 days of the determination date of withdrawal, and to determine the date of withdrawal within 30 days after the period of enrollment. Per Section 3508 of the CARES Act, a return of Title IV funds to the USDOE was not required for the spring semester for student withdrawals related to a qualifying emergency. However, institutions were still required to perform a return of Title IV calculation in order to determine the amount of Title IV funds that would otherwise have to be returned. 34 CFR 690.80(b)(2)(ii) requires the university to recalculate the Pell award based on the student's enrollment status to reflect only those classes for which the student actually began attendance if a student's projected enrollment status changes during a payment period before the student begins attendance in all of his or her classes for that payment period. Cause: UL Lafayette did not have adequate procedures in place to identify the correct withdrawal date for all students. Additionally, UL Lafayette did not identify a student who failed to start the second term classes, of a split-term semester before withdrawing from the university and therefore required an adjustment to the student?s Pell award. Effect: UL Lafayette failed to accurately calculate the return of funds and to return funds to the USDOE. Additionally, one student was over awarded a Pell grant based on their enrollment status. Recommendation: Management should strengthen controls to ensure that all return of funds calculations are performed accurately and in compliance with federal regulations. Additionally, management should identify students with incorrect withdrawal dates, recalculate the return of Title IV amounts and return any additional funds to the USDOE. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-129).

2020-042 - Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security Award Years: 2020 Award Numbers: P063P191529, P268K201529 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: UL Lafayette did not have a formal documented risk assessment or related safeguards that address the following minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information: ? Employee training and management; ? Information systems including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing and responding to attacks, intrusions, or other systems failures. UL Lafayette has information technology policies and practices that require employee training, information technology security policies and procedures, a documented disaster recovery plan, and password policy, but have not performed a formal documented risk assessment including safeguards to address identified risk as required by federal regulations. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program. (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: UL Lafayette did not perform a formal documented risk assessment including safeguards to address identified risks. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk for unauthorized disclosure, misuse, alteration, destruction or other compromise of student information and results in noncompliance. Recommendation: Management should develop, implement, and maintain information security programs that include a formal documented risk assessment of relevant areas of operation, and design and implement safeguards to control the risks identified in regards to student information. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-130).

2020-043 - Noncompliance with Gramm-Leach-Bliley Act Regarding Student Information Security Award Year: 2020 Award Numbers: P063P191521, P268K201521 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The University of Louisiana at Monroe (ULM) did not have a formal documented risk assessment or related safeguards that address the following minimum requirements of the Gramm-Leach-Bliley Act standards for safeguarding student information: ? Employee training and management ? there are information technology policies and practices that require employee training, but no documented risks or sufficiency of these safeguards. ? Information systems including network and software design, as well as information processing, storage, transmission and disposal ? there are Banner system policies and procedures, but no documented risks or sufficiency of these safeguards. ? Detecting, preventing and responding to attacks, intrusions, or other systems failures ? there is a documented disaster recovery plan and password policy, but no documented risks or sufficiency of these safeguards. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program. (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi)]. Cause: ULM has not performed a formal documented risk assessment including safeguards to address identified risks. Effect: Failure to meet the minimum requirements of the Gramm-Leach-Bliley Act increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information and results in noncompliance. Recommendation: Management should develop, implement, and maintain information security programs that include a formal documented risk assessment of relevant areas of operation, and design and implement safeguards to control the risks identified in regards to student information. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-131).

2020-044 - Noncompliance with Borrower Data Reconciliation Requirements Award Year: 2020 Award Numbers: P268K191519, P268K201519 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: UNO did not perform monthly reconciliations of the SAS data files to the institution?s financial records, as required by federal regulations. Each month, the USDOE?s COD system provides the institution the SAS data file, which should reconcile to the institution?s financial records to ensure the institution has transmitted accurate and complete data to the COD system for all Federal Direct Student Loan borrowers in accordance with federal requirements. Criteria: 34 CFR 685.300(b)(5) requires that schools must, on a monthly basis, reconcile institutional records with Direct Loan funds received and Direct Loan disbursement records submitted to and accepted by the USDOE. Cause: UNO had not established formal procedures and did not have adequate supervisory review to ensure the monthly reconciliations of the SAS data files were being performed. Effect: Failure to perform the monthly reconciliations could result in undetected discrepancies between the institution?s financial records and data in the COD system. Recommendation: Management should establish written procedures for completing the monthly reconciliations and should provide supervisory oversight to ensure that the reconciliations are being performed in accordance with federal requirements. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a plan of corrective action (B-133).

2020-045 - Noncompliance with Gramm-Leach-Bliley Act - Student Information Security Requirements Award Year: 2020 Award Numbers: P063P181519, P063P191519, P268K191519, P268K201519 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: UNO did not have a documented risk assessment as required by the Gramm-Leach-Bliley Act and UNO?s Program Participation Agreement with the USDOE for the federal SFA programs. Although UNO has certain information technology policies and safeguards in place, it did not formally document its risk assessment process and the related safeguards to address those risks, in accordance with federal regulations. Criteria: 16 CFR 314.4 requires entities to develop, implement, and maintain information security programs by: (a) Designating an employee or employees to coordinate an information security program. (b) Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: (1) Employee training and management; (2) Information systems including network and software design, as well as information processing, storage, transmission, and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers [16 CFR 313.3(k)(2)(vi]. Cause: This occurred because UNO personnel were not aware of this requirement. Effect: As a result, UNO cannot evidence compliance with federal regulations that require the consideration of risk for unauthorized disclosure, misuse, alteration, destruction, or other compromise of student information. Recommendation: Management should ensure a formal documented risk assessment is prepared identifying risks for relevant areas of operation, and ensure safeguards are in place to control the risks identified in regards to student information. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a plan of corrective action (B-134).

2020-046 ? Inadequate Controls over Billing for Behavioral Health Services Award Years: 2019, 2020 Award Numbers: 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2019-022) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, the Louisiana Department of Health (LDH), the managed care organizations (MCOs), and Magellan Health Services (Magellan) did not have adequate controls in place to ensure that behavioral health services in the Medical Assistance Program (CFDA 93.778, Medicaid) and Children?s Health Insurance Program (CFDA 93.767, CHIP) were properly billed, and that improper encounters were denied. For fiscal year 2020, we identified approximately $10.5 million in encounters for services between July 1, 2019, and June 30, 2020, that were paid by the MCOs and Magellan even though encounters did not comply with the LDH coding requirements and fee schedule. Our analysis identified the following instances of billing errors: ? Providers were paid $9,088,625 for 147,183 encounters that were billed using incorrect procedure and modifier codes. ? Providers were paid $1,425,875 more than indicated on the LDH fee schedule for 32,703 encounters for behavioral health services. ? Providers were paid $1,722 for 45 encounters for improperly billed add-on behavioral health services. Criteria: LDH?s fee schedule outlines procedure codes for services and the applicable billing rates. Some services require that procedure codes also contain modifier codes which indicate information such as the age of the recipient, location where the service was provided, the educational background of the person providing the service, and the license(s) they have obtained. The LDH fee schedule outlines different rates depending on the procedure code and modifier codes. The MCOs can optionally pay more than the minimum LDH fee schedule. However, LDH does not currently maintain a list of these providers and therefore cannot determine if an encounter paid at an excessive rate was improperly billed. For the amount reported, the MCOs confirmed that they did not have alternative fee schedules. According to MCO guidance to providers, add-on services are reimbursable when provided in addition to the appropriate primary service performed by the same provider and cannot be billed as standalone services. For the amount reported, add-on services were paid without the required primary service. Cause: The billing errors could be avoided by LDH, the MCOs, and Magellan applying system edits that would deny encounters when billing and fee schedule requirements are not followed. Effect: Without the required modifiers, the encounter does not contain enough information to determine that the billing was appropriate. It is important that encounter data is accurate because LDH and other stakeholders, such as the Medicaid Fraud Control Unit within the Attorney General?s Office, use this data to identify improper payments and potential fraud. LDH also uses this encounter data to establish per member per month rates for the MCOs. Recommendation: LDH management should implement adequate internal controls to ensure that encounters are coded correctly, which could include edit checks to deny improper billings. Management?s Response and Corrective Action Plan: Management did not concur with the auditor?s recommendation regarding implementing encounter edits but did detail other procedures currently in place and to be implemented (B-29). Auditor?s Additional Comments: Incomplete encounter data submission by the MCOs limits LDH?s ability to fulfill its role as the contract monitor of the MCOs. Although LDH noted it holds the MCOs accountable for implementing necessary claim system edits, if LDH does not require the proper coding of procedure codes and modifiers, it would have to implement the multiple system evaluations and verifications employed by the MCOs in order to ensure that the encounter data submitted was complete and accurate. LLA is not recommending that LDH limit encounter acceptance to only those encounters that are in alignment with the Medicaid fee schedule, but instead is recommending that LDH establish edits that flag, but do not deny, instances where providers are paid rates that are outside of the fee schedule. This would allow LDH to easily identify and review these encounters and confirm with each MCO that the rates at which each provider was paid are correct. LLA removed those providers with special, negotiated rates from the analysis and only analyzed those providers that the MCOs indicated should have been paid at the rate listed on LDH?s fee schedule. LDH?s Specialized Behavioral Health fee schedule outlines which primary and add-on codes are supposed to be used in conjunction with one another. The primary procedure codes that LDH identified as being provided for the add-on services identified by the LLA?s analysis are not the proper primary codes listed on the fee schedule for the identified add-on services. Rather, the primary procedure codes identified by LDH are procedure codes for established patient office visits that, in many cases, allow the provider to bill at a rate higher than the primary procedure code identified on LDH?s fee schedule allows.

2020-047 ? Inadequate Controls over Consideration of Lottery Winnings for Medicaid Eligibility Award Years: 2018 - 2020 Award Numbers: 1805LA5MAP, 1905LA5MAP, 2005LA5MAP Compliance Requirement: Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Based on data obtained from the Louisiana Lottery Corporation and Medicaid recipient data, auditors identified 38 recipients each with Louisiana lottery prizes over $80,000 claimed from February 2018 through March 2020 for which LDH did not count lottery winnings as income in its modified adjusted gross income (MAGI) based eligibility determinations for the Medicaid program as required by federal regulations. Criteria: In February 2018, Congress passed Public Law 115-123 that amended the Social Security Act for treatment of qualified lottery winnings and other qualified lump sum income, including winnings from any gaming activities, for the purposes of income eligibility under Medicaid. Under the new regulation, qualified lottery or other lump sum winnings of $80,000 and greater occurring on or after January 1, 2018, are now counted as income, for MAGI-based determinations, over a period of months instead of just in the month received. For amounts greater than or equal to $80,000 but less than $90,000, the winnings would be counted as income over a period of two months. For amounts greater than or equal to $90,000 but less than $100,000, the winnings would be counted as income over a period of three months. For amounts $100,000 and over, an additional month would be added for each increment of $10,000 for the purposes of income counting for a maximum of 120 months for winnings or income of $1,260,000 or more. The regulation stipulates that the income and winnings are only counted for the recipient of winnings and cannot be counted for any other members of the household, including a spouse. In addition, the state is required to notify the recipient of the loss of eligibility, of opportunities to enroll in a qualified health plan through the Federal Healthcare Marketplace (Exchange), and the date on which the recipient would no longer be ineligible for Medicaid due to lottery winnings or qualified lump sum income. In Louisiana, winnings that exceed $80,000 from Louisiana Lottery Corporation drawings and scratch-off games, as well as multi-state lottery drawings are considered countable lump sum income under the new regulations. Louisiana accepted a temporary increase in federal match for certain Medicaid expenditures under the Families First Coronavirus Response Act (FFCRA) 6008, which was enacted due to the March 2020 national public health emergency due to the COVID-19 pandemic. As a condition of the temporary increase, FFCRA prohibits the agency from terminating Medicaid coverage unless a recipient ?requests a voluntary termination of eligibility? or ?ceases to be a resident of the state.? Also, as a result of the public health emergency, LDH submitted to the Centers for Medicare and Medicaid Services (CMS) modifications to its? Eligibility Verification Plan to allow for the processing of eligibility determinations based on self-attested income amounts. The Eligibility Verification Plan addendum allows the agency to temporarily accept self-attested income for eligibility determinations. Through the conclusion of the emergency, the agency is not required to verify income including lottery winnings and is not permitted to remove recipients from Medicaid for income discrepancies. Once the COVID-19 emergency is concluded, the agency is required to return to its thorough post-enrollment verification to ensure eligibility. Cause: LDH did not have adequate controls to ensure compliance with the federal requirement over consideration of lottery winnings in MAGI-based eligibility determinations for the Medicaid program. LDH updated its policy for the new income counting requirements in April 2020 but still relies on applicants and recipients to self-report winnings. LDH is currently in the process of negotiating an agreement with the Louisiana Lottery Corporation to obtain data on a regular basis for the purposes of eligibility determinations. Effect: As a result, the individuals obtained and/or maintained Medicaid eligibility during months in which their winnings made them ineligible while Medicaid payments were made on their behalf. Payments associated with these individuals total $120,372 ($108,299 federal and $12,073 state funds) through June 30, 2020. Of the 38 Medicaid recipients? auditors identified as Lottery winners in the period February 2018 through March 2020, a total of six recipients had $6,969 in payments made on their behalf during the PHE period from March 2020 through June 2020. Questioned costs are considered to be $113,403 ($102,628 federal and $10,775 state funds). Recommendation: LDH should ensure that lottery and all other qualified lump sum incomes are considered as part of MAGI-based eligibility determinations as required by federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-34).

2020-048 ? Inadequate Controls over Monitoring of Abortion Claims Award Years: 2019, 2020 Award Numbers: 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2019-025) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LDH did not have adequate controls to ensure compliance with federal regulations prohibiting the use of federal funding for abortion claims. Criteria: 42 CFR 441, Subpart E and 42 USC 1397ee(c) prohibit Medicaid and CHIP funding for abortion services except in instances where an abortion is necessary to save the mother?s life or if the pregnancy is the result of an act of rape or incest. Under managed care, LDH pays the health plans monthly premiums for enrolled recipients. The health plans pay provider claims for services provided to enrolled recipients and submit the claims to LDH as encounter claims. Cause: LDH included provisions in the Healthy Louisiana managed care contracts requiring the health plans to comply with the federal regulations, but LDH did not have procedures in place to monitor the health plans? compliance with the contract requirement until May 2020. The health plans started submitting monthly reporting for April 2020 in May 2020. In addition, LDH started a claims review for encounters with dates of service from January 2018 through June 30, 2020. As of January 2021, LDH was still reviewing documentation from the health plans to complete the claims review. Effect: The managed care health plans may have paid for abortion services that did not meet exceptions noted in federal regulations, and LDH may have accepted those claims as encounters. Encounters are considered in future premium rate setting and are used for reporting and monitoring of the Medicaid and CHIP programs. Recommendation: LDH should complete its current claims review and continue on-going monitoring of encounter claims for Medicaid and CHIP recipients to ensure compliance with federal regulations regarding funding of prohibited abortion claims. Management?s Response and Corrective Action Plan: Management did not concur with the finding but did concur with the recommendation. In its response dated February 10, 2021, LDH noted it is nearing completion of the claims review mentioned above (B-37).

2020-049 ? Inadequate Controls over Service Providers with Closed Enrollment Award Years: 2015 - 2020 Award Numbers: 1505LA5021, 1505LA5MAP, 1605LA5021, 1605LA5MAP, 1705LA5021, 1705LA5MAP, 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH paid $287,617 ($190,302 federal funds and $97,315 state funds) in fiscal years 2016 through 2020 for claims with service dates occurring after the service providers were no longer enrolled. In an analysis of 23,389 service providers with activity during fiscal year 2020, we noted 235 providers with enrollment end dates during the fiscal year or prior. Of the 235 providers, we noted 27 providers with claims paid for service dates after the providers? enrollment end date. After reviewing the information with LDH, errors were noted for 16 providers as detailed below. ? Thirteen providers with Medicare crossover claims totaling $85,264, in which LDH did not ensure the service providers were enrolled in Medicaid on the service dates being billed. Even if a provider is enrolled with CMS as a Medicare provider, the provider must be enrolled as a Medicaid provider to perform and be paid for services in the Medicaid and CHIP programs. ? Three providers with claims totaling $202,353, in which enrollment end dates were applied retroactively by LDH; however, LDH had already paid for services dates during that period. LDH did not consider if those payments needed to be recouped from the provider. Criteria: LDH enrolls fee-for-service providers into the Medicaid and CHIP programs, which includes entering into provider agreements as required by 42 CFR 431. Provider enrollment can end for various reasons, such as inactivity for a prolonged period, state or federal exclusion, license issues, or the provider elects to terminate enrollment. Cause: LDH lacked adequate procedures to ensure claims are only paid for service dates in which the service provider is enrolled in Medicaid. Effect: Payments made for services that fall on dates that service providers are not enrolled in the program increases the risk that payments were made to providers that should not be providing services to Medicaid and CHIP recipients. Recommendation: LDH should develop and implement procedures to ensure claims are only paid for dates of service during time periods in which the provider was enrolled in the program. In the cases of retroactive closures, LDH should develop and implement procedures to consider and address, as necessary, any claims already paid during that retroactive closure period. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-39).

2020-050 ? Inadequate Controls over Waiver Services Providers Award Years: 2019, 2020 Award Numbers: 1905LA5MAP, 2005LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2019-027) See Schedule of Findings and Questioned Costs for chart/table Condition: For the ninth consecutive year, LDH paid Medicaid Home and Community Based Services (HCBS) claims for the New Opportunities Waiver (NOW), Residential Options Waiver (ROW), and Community Choices Waiver (CCW) for waiver services that were not documented in accordance with provider manuals. NOW and ROW are administered by the LDH Office for Citizens with Developmental Disabilities (OCDD). CCW is administered by the LDH Office for Aging and Adult Services (OAAS). Waiver services are accessed through support coordinators who assist with development and monitoring of the recipient?s plan of care (POC). Our testing of waiver services included 126 claims paid in fiscal year 2020 totaling $33,255 paid to two providers for seven recipients. The recipients received services from three waivers: NOW, ROW, and CCW. Our test identified errors for 57 claims, some claims having multiple errors. For the NOW and ROW waivers administered by OCDD, the following were noted: ? For 38 claims for three recipients, the waiver services provider did not provide documentation to support deviations from the approved POC. ? For five claims for one recipient, auditors were unable to determine if a deviation from the POC occurred because time sheets/electronic visit verification (EVV) documentation and units billed were not consistent. Provider could not provide explanation or documentation to explain why EVV documentation did not match units billed. For the CCW waiver administered by OAAS, the following were noted: ? For two claims for one recipient, the waiver services provider did not provide adequate documentation to support billed services. These claims total $1,035 ($756 federal funds and $279 in state funds) and are considered questioned costs. ? For 14 claims for two recipients, the waiver services provider did not provide documentation to support deviations from the approved POC. According to the CCW provider manual, significant deviations must be documented. Significant is not defined. Errors noted were deviations of 30 minutes or more. Criteria: LDH implemented EVV in fiscal year 2019 to be used by HCBS waiver providers. EVV is a web-based system that electronically records and documents the precise date, start time, and end times that services are provided to recipients. Time documented through EVV should be the time billed to Medicaid for services. Providers are required to maintain certain other supporting documentation to support all time billed. Auditors used LDH?s provider manuals to identify required documentation. Provider manuals are intended to give a provider the information needed to fulfill its vendor agreement with the state of Louisiana, and is the basis for federal and state reviews of the program. The POC documents the recipient?s assessed needs and types and quantity of services to address those needs and costs related to services. Direct service providers provide care to a recipient based on the approved POC. According to the ROW provider manual, providers are to record any changes or deviations from the POC. According to the NOW provider manual, an occasional or temporary deviation from a recipient?s scheduled services is acceptable as long as the services altered are recipient-driven, person-centered, and occur within the prior authorization. According to the CCW provider manual, significant deviations must be documented. Cause: The errors noted occurred because LDH failed to ensure that NOW, ROW, and CCW providers follow the provider manuals? requirements, which includes review of documentation to support services billed for accuracy and documenting deviations from the POC. Effect: Without adequate documentation a provider cannot substantiate and auditors cannot verify that the deviations were recipient-driven and person-centered as required. Without adequate supporting documentation and compliance with LDH provider manuals, there is increased risk that services billed and paid may not actually have been performed, recipients may not receive needed services as required by their POC, and limited resources may not be allocated appropriately to best meet recipient needs. Recommendation: LDH should ensure all provider manuals for waiver services are enforced, including documentation to support claims and evidence deviations from the approved POC meet the needs of the recipient. LDH should also consider additional provider training regarding documentation requirements. Management?s Response and Corrective Action Plan: Management concurred in part and provided a corrective action plan (B-42).

2020-051 ? Inadequate Internal Control over Eligibility Determinations Award Years: 2019, 2020 Award Numbers: 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH lacked adequate internal control over eligibility determinations in the Medicaid and CHIP programs during fiscal year 2020. In a non-statistical sample of 60 recipients of 1,871,664 determined eligible during fiscal year 2020, deficiencies were found in case record documentation for six recipients (10%), with one recipient?s case record containing more than one error. Our test noted the following: ? For three of 60 (5%) recipients, case records did not support financial requirements for eligibility based on income. In these instances, self-employment income was not verified, income reported was not counted correctly, and updated wage information was obtained in LaMEDS but not considered. ? For one of 60 (2%) recipients, the case record did not support categorical requirements for the eligibility group assigned. In this instance, a pregnant recipient was included in the adult group rather than the pregnant woman group. ? For two of 60 (3%) recipients, case records did not support non-financial requirements for the eligibility group assigned. In one instance, LDH did not obtain a Social Security number (SSN) or proof of application for a SSN at application or renewal. In another instance, the case record does not support the continuity of stay requirement for long-term care eligibility. ? For one of 60 (2%) recipients, the case record did not support retroactive eligibility as applied. According to LDH policy for pregnant woman eligibility, retroactive eligibility cannot begin before the first month of pregnancy. However, retroactive eligibility was applied for three months prior to the first month of pregnancy. Criteria: 42 CFR 431 and 42 CFR 435 require that in order to be considered eligible, a recipient must meet all eligibility factors and the recipient case record must include facts to support agency eligibility decision. Eligibility determinations include consideration of categorical, non-financial, and financial requirements. Cause: LDH employees did not adhere to control procedures to ensure case records support eligibility decisions per federal regulations. Effect: Proper eligibility determinations are critical to ensuring appropriate service eligibility, appropriate premium payments, and appropriate federal match rate on expenditures. LDH paid $20,372 ($18,143 in federal funds and $2,229 in state funds) for these recipients for periods during fiscal year 2020, which are considered questioned costs. Recommendation: LDH should ensure its employees follow procedures relating to eligibility determinations in the Medicaid and CHIP programs to make sure case records support eligibility decisions. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-47).

2020-052 ? Noncompliance with Managed Care Provider Enrollment Requirement Award Years: 2019, 2020 Award Numbers: 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2019-030) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, LDH did not enroll and screen Healthy Louisiana managed care providers and dental managed care providers as required by federal regulations. Currently, the managed care plans continue to enroll and screen all managed care providers, in violation of federal regulations. Criteria: 42 CFR 438.602 (2016 Managed Care Final Rule) and Section 5005 of the 21st Century Cures Act require that the enrollment process include providing the Medicaid agency with the provider?s identifying information including the name, specialty, date of birth, SSN, national provider identifier, federal taxpayer identification number, and state license or certification number of the provider. Additionally, the state agency is required to screen enrolled providers, require certain disclosures, provide enhanced oversight of certain providers, and comply with reporting of adverse provider actions and provider terminations. By using the federally-required process, managed care providers must participate in the same screening and enrollment process as Medicaid and CHIP fee-for-service providers. LDH was required to enroll and screen all Healthy Louisiana managed care providers by January 2018 and dental managed care providers by July 2018. Cause: LDH noted that enrollment and screening of managed care providers was to be performed as part of a new provider management system. The contract for the new system was terminated in April 2020. Effect: LDH cannot ensure the accuracy of provider information obtained from the Louisiana Medicaid managed care plans and cannot ensure compliance with enrollment requirements defined by law and the Medicaid and CHIP state plan. LDH accepted 90.7 million Healthy Louisiana encounter claims totaling $5.9 billion and 3.8 million dental encounter claims totaling $132 million in fiscal year 2020 from the managed care plans and paid $8.3 billion in Healthy Louisiana premiums and $174 million in dental premiums. Recommendation: LDH should ensure all providers are screened, enrolled, and monitored as required by federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-49).

2020-053 ? Noncompliance with Prenatal Service Third-Party Liability Requirements Award Years: 2019, 2020 Award Numbers: 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: Yes (Prior Year Finding No. 2019-031) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LDH failed to implement controls to ensure compliance with revised third-party liability requirements for prenatal and pregnancy-related services. Criteria: 42 CFR 433 requires that the Medicaid and the CHIP programs are the payers of last resort. In most cases, federal law requires states to apply cost avoidance measures to claims by which all other payers are identified and payments from those identified payers are applied to the claim first. Federal funds would then be used for the remaining balance as applicable. Previously, regulations considered prenatal and pregnancy-related services an exception to the cost avoidance requirement and required states to pay prenatal and pregnancy-related claims without regard to any other liable third party. States could seek to recover payments from another liable third party at a later date through a process known as pay and chase. The Bipartisan Budget Act of 2018 (Public Law 115-123) revised the Social Security Act, the authorizing legislation for Medicaid and CHIP programs, to eliminate the cost avoidance exception for prenatal services and pregnancy-related services effective in February 2018. Cause: During fiscal year 2020, LDH did not update the managed care contracts to require compliance with the revised regulation and did not monitor plan compliance with the revised regulation. Effect: As a result, the managed care health plans may have paid for services that should have been cost avoided. Managed care claims payments are sent to LDH as encounters that are used by LDH?s actuary for future rate setting. Recommendation: LDH should ensure that Medicaid and CHIP programs are the payers of last resort by ensuring that cost avoidance measures are applied by the managed care health plans for prenatal services and pregnancy-related services as required by federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-51).

2020-054 ? Noncompliance with Provider Revalidation and Screening Requirements Award Years: 2019, 2020 Award Numbers: 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2019-032) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, LDH did not perform five-year revalidations; screenings based on categorical risk of fraud, waste, or abuse; and monthly checks of the federal excluded party database, as required by federal regulations for all Medicaid and CHIP fee-for-service providers. Based on information provided by LDH, approximately 80% of providers with claims activity in fiscal year 2020 have not had a risk-based screening with a majority of those providers enrolled more than five years ago. In addition, LDH did not routinely check one of the required federal databases to determine if providers have been excluded from participation in federal programs. While LDH checked the List of Excluded Individuals/Entities (LEIE) on a monthly basis, it did not perform checks of the System for Award Management (SAM) monthly as required. Criteria: 42 CFR 455 Subpart E requires that LDH screen all providers according to the provider?s categorical risk level upon initial enrollment, re-enrollment, or revalidation of enrollment. LDH must complete a revalidation of enrollment for all providers, regardless of type, at least every five years. The required screening procedures for each provider varies based on the risk score ? limited, moderate, or high. For example, a high-risk score requires additional screening procedures including criminal background checks and fingerprinting. LDH submitted and received the Medicaid State Plan approval in fiscal year 2012 regarding compliance with revalidation and screening requirements. 42 CFR 455 Subpart E required LDH to check the LEIE and the SAM on at least a monthly basis. The SAM database includes information on providers excluded from contracting with the federal government. Cause: In response to the prior-year finding, LDH noted that performance of all required revalidations, screenings, and monthly checks would be implemented in a new provider management system. The contract for the new system was terminated in April 2020. LDH now plans to use the current provider enrollment contractor for revalidations, monthly SAM database checks, and risk-based screening for all provider types. Effect: Proper enrollment and revalidation, including screening based on categorical risk and monthly checks of required databases, would enable the state to identify ineligible providers that should be rejected or excluded from the program. Recommendation: LDH should ensure all providers are screened based on categorical risk level upon initial enrollment, re-enrollment, and revalidation of enrollment as required by federal regulations. Also, LDH should perform revalidation of enrollment on all providers at least every five years. In addition, LDH should ensure all required databases are checked at least monthly. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-53).

2020-055 ? Noncompliance with Third-Party Liability Assignment Award Years: 2019, 2020 Award Numbers: 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2019-033) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fourth consecutive year, LDH failed to maintain evidence of notification of third-party liability (TPL) assignment as required for eligibility in the Medicaid and CHIP programs. Criteria: Per 42 CFR 433, Medicaid is the payer of last resort. As a condition of eligibility, each applicant/enrollee must assign to the state their individual rights to medical support and other third-party payments, and such rights of any other eligible individuals under their legal authority. By state law, TPL assignment is automatic but notification must be provided to the applicant/enrollee. Cause: Historically, LDH provided notification to an applicant/enrollee by including assignment language on Medicaid and CHIP applications. LDH utilizes both paper and electronic applications. Prior to the new eligibility system, LaMEDS, implemented in calendar year 2018, TPL assignment language was not included as part of electronic application summaries in all recipient case records. LDH planned corrective action in conjunction with the launch of LaMEDS, but LDH?s corrective action was prospective in nature and did not attempt to remedy cases in which recipients with case files lacking TPL assignment notification do not complete a new application in LaMEDS. In response to the fiscal year 2019 finding, LDH planned to include the notification in Decision Letters for all approvals and renewals which each recipient would receive at least annually. However, LDH did not implement any corrective action in fiscal year 2020. Effect: Third parties are legally-liable individuals, institutions, corporations (including insurers), and public or private agencies who are or who may be legally responsible for paying medical claims. Without the assignment of TPL rights, the state may be at risk for payments that should be the legal obligation of another party. Recommendation: LDH should ensure notification of TPL assignment is included in each Medicaid and CHIP recipient case record as part of required documentation to support the eligibility decision. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-55).

2020-056 ? Weaknesses in Controls over LaMEDS Award Years: 2019, 2020 Award Numbers: 1905LA5021, 1905LA5MAP, 2005LA5021, 2005LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2019-034) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LDH had weaknesses in controls over its Medicaid and CHIP eligibility and enrollment system, LaMEDS. LaMEDS was implemented in November 2018. All recipient eligibility records are stored in LaMEDS. Criteria: LDH is the single state agency responsible for the administration of the Medicaid and CHIP programs. As such, LDH is responsible for adequate internal control over any system used in administration of the program. In addition, LDH is considered a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). According to the HIPAA Security Rule, a covered entity must implement and maintain documented procedures to determine, assign, and revoke access to electronic protected health information appropriately, and review system activity regularly. We evaluated system controls based on best practices, as defined by Control Objectives for Information and Related Technology, a framework developed by the Information Systems Audit and Control Association. Cause: We determined during fiscal year 2020, LDH lacked documented procedures for disabling user accounts upon separation and documented procedures for identifying contractors who no longer need access to LaMEDS. In addition, LDH failed to complete user access reviews during fiscal year 2020, which should be done at least annually. Effect: A lack of documented procedures and proper monitoring over user access may lead to inappropriate access that may violate HIPAA Security Rules because users may retain access to protected health information after they no longer need access. Recommendation: Management should establish procedures for: immediately disabling separated employee access; monitoring contractors and terminating their access when no longer needed; performing user access reviews at least annually; and making appropriate changes as a result of the user access reviews. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan. LDH provided that Medicaid has a procedure to perform annual user access reviews and noted the November 2019 ransomware attack and the COVID-19 public health emergency in March 2020 delayed timely completion of the annual user access review. LDH also noted that a new review is currently in progress that should be completed in February 2021 (B-57).

2020-057 ? Lack of Internal Controls over and Noncompliance with Subrecipient Monitoring Requirements Award Year: 2020 Award Numbers: NU62PS005012-04-00, NU62PS005022-03-00, NU62PS005022-03-04, NU62PS924522-02-00, NU62PS924522-02-03 Compliance Requirement: Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: OPH did not have adequate controls in place to monitor subrecipients of the HIV Prevention Activities Health Department Based program (CFDA 93.940). ? OPH did not evaluate any subrecipient?s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the award as required by federal regulations. ? From a population of 25 contracts with expenditures totaling $2,281,253, we selected a non-statistical sample of six contracts for testing with expenditures totaling $662,893. In addition, we tested three individually important contracts with expenditures totaling $3,594,770. Although OPH documented site visits for the subrecipients randomly selected for testing, OPH could not provide documentation of site visits for the subrecipients related to the individually important contracts. Criteria: 2 CFR 200.332(b) requires pass-through entities to evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring. 2 CFR 200.332(d) states that all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Cause: OPH did not evaluate subrecipients? risk of noncompliance and lacked documentation of site visits for individually important contracts. Effect: Failure to properly monitor subrecipients results in noncompliance with federal regulations and increases the likelihood of disallowed costs that may have to be returned to the federal grantor. Recommendation: OPH should ensure that risk evaluations are performed for all subrecipients to determine the appropriate monitoring. In addition, OPH should establish a plan based on risk, such as a rotation schedule, to ensure that all subrecipients are monitored periodically. Management?s Response and Corrective Action Plan: Management did not concur with the finding and asserts that its risk evaluation methodology meets the requirements of 2 CFR 200.332(b). Management acknowledged that site visit meetings were not documented and provided a corrective action plan to ensure that all site visits are documented with agendas and written summary reports (B-63). Auditor?s Additional Comments: LDH asserts that all OPH subrecipients undergo yearly financial and compliance audits and referred to a checklist documenting the factors that OPH considered in evaluating each subrecipients? risk of noncompliance with federal regulations. The purpose of the checklist is to determine if the subrecipient or contractor requires an annual audit, a requirement of 2 CFR 200.332(d)(4) and (f). However, the checklist does not address the risk of noncompliance with federal regulations in accordance with 2 CFR 200.332(b). Management did not provide documentation of conclusions reached as to the assessed risk of noncompliance that determined the appropriate monitoring of each subrecipient.

2020-058 ? Lack of Internal Controls over Program Expenditures Award Year: 2020 Award Numbers: NU62PS005012-04-00, NU62PS005022-03-00, NU62PS005022-03-04, NU62PS924522-02-00, NU62PS924522-02-03 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: OPH lacked internal controls to ensure compliance with regulations over the HIV Prevention Activities Health Department Based program related to the activities allowed or unallowed, allowable costs/cost principles, and period of performance compliance requirements. From a population of 703 payments occurring in fiscal year 2020 totaling $6,956,692, we selected a non-statistical sample of 49 payments made to subrecipients and vendors who provided services related to the HIV Prevention Activities Health Department Based program. Based on our audit procedures, we noted 21 (43%) payments with exceptions as follows: ? Nine (18%) payments were not approved by an appropriate supervisor and eight of those payments did not include enough information to determine if the account coding was accurate. ? Twelve payments (24%) did not include enough information to determine if the account coding was accurate. Criteria: Per 2 CFR 200.302(a), each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-federal entity's financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.302(b)(7) states the financial management system of each non-federal entity must provide for the written procedures for determining the allowability of costs in accordance with cost principles and the terms and conditions of the federal award. Cause: OPH did not ensure payments to vendors were properly supported and approved in accordance with federal regulations. Effect: Failure to adequately maintain supporting documentation and approve program expenditures increases the risk of unallowable costs requiring reimbursement to the federal grantor. Recommendation: OPH should ensure that adequate internal controls are established and followed to ensure all expenditures of federal awards are adequately supported and approved by an appropriate supervisor. Management?s Response and Corrective Action Plan: Management did not concur with the finding, noting that the invoices were reviewed but the supervisors did not document their approval, and based on its review, the coding agreed to the purchase order and was applicable to the grant. Management provided a corrective action plan to ensure evidence of approval of all payments (B-68). Auditor?s Additional Comments: Documentation provided by OPH did not indicate how each portion used to code expenditures to the different grants or projects within the HIV Prevention Activities Health Department Based program was determined to enable the auditor to conclude that the expenditure coding was correct.

2020-059 - Weakness in Controls over Research and Development Project Closeouts and Accounting Records Award Years: 2019, 2020 Award Numbers: 5P60AA009803-24, A1801385001A01, UL1TR001417 Compliance Requirement: Period of Performance Pass-Through Entities: University of Alabama, University of California Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Louisiana State University Health Sciences Center in New Orleans (LSUHSC-NO) did not have adequate controls over project closeouts or accounting records for the R&D cluster federal program. In a non-statistical sample of 40 R&D cluster expense transactions from a population of 41,859 R&D cluster expense transactions, five (12.5%) transactions for expenses or correcting entries were posted to the project between 133 and 244 days after the project?s period of performance ended. Criteria: 2 CFR 200.344 requires (a) that the recipient must submit, no later than 120 calendar days (or 90 days for a subrecipient) after the end of the period of performance, all reports required by the terms and conditions of the award and (b) unless the federal awarding agency or pass-through entity authorizes an extension, a non-federal entity must liquidate all financial obligations incurred under the federal award no later than 120 calendar days after the end date of the period of performance. Additionally, LSUHSC-NO?s Sponsored Agreement Closeout Policy requires that completed sponsored agreements with surplus and/or deficit residual balances remaining in the project be certified and transferred to an appropriate, non-sponsored, departmentally-funded account or another sponsored project within 90 days. LSUHSC-NO?s Sponsored Projects Administration Cost Transfer Policy dated 1/11/2019 cautions that cost transfers will not be processed to cover cost overruns, to avoid restrictions by the sponsor, to use up unspent funds, or for reasons of convenience or broadly-defined ?errors.? Cause: These exceptions occurred because (1) the accounting system, PeopleSoft Commitment Control, allows certain personnel and other expenses to continue to post to projects after the project has ended unless a form, such as a personnel status change form, is processed to update account coding in the system; (2) projects are not being closed out properly as they end, which includes submitting all required forms for updating accounting records; and (3) project budgets were not adequately monitored to ensure that expenses in the accounting system were charged to the correct project, and any errors or budget overruns were identified and addressed in a timely manner. Effect: Untimely project updates in the accounting system increase the risk that expenses will be charged to the wrong project, which hinders management?s ability to effectively monitor the budget and may result in budget overruns that would need to be covered with other funding sources, increase the number of corrections required at year-end to ensure accurate financial reporting, and may result in noncompliance with federal program requirements. None of these costs were requested for federal reimbursement on the closed project. Recommendation: Management should continue to monitor budgets and ensure that budget overruns and errors are identified and corrected in a timely manner. Management should ensure that projects are effectively closed out including processing all required forms and updating the accounting system in a timely manner. Management should consider implementing a system control to prevent costs from being charged to projects in the accounting system beyond the project close out period. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-75).

2020-060 - Noncompliance with Subrecipient Monitoring Requirements Award Years: 2017, 2018, 2020 Award Numbers: R01NS096225, R24OD018553, R44AI103982 Compliance Requirement: Subrecipient Monitoring Pass-Through Entity: Inhibikase Therapeutics Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LSUHSC-S did not adequately monitor subrecipients under the R&D Cluster. In a test of all six subrecipients, we noted that for two of the subrecipients, LSUHSC-S did not receive an audit report to ensure that required audits were completed within nine months of the subrecipient?s fiscal year-end, as required by federal regulations. Criteria: Per 2 CFR 200.331(f), pass-through entities are responsible for ensuring that subrecipients expending $750,000 or more in federal awards during the subrecipient?s fiscal year, meet the audit requirements of 2 CFR Part 200, subpart F. 2 CFR 200.512 states that required audits must be completed within nine months of the end of the subrecipient?s audit period. 2 CFR 200.331(d)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings within six months after receipt of the subrecipient?s audit report and ensure that the subrecipient takes timely and appropriate corrective action on all findings. Cause: LSUHSC-S did not maintain a current audit requirement certification form which is used by LSUHSC-S to determine if each subrecipient needs an audit. Effect: Failure to perform adequate monitoring impairs LSUHSC-S?s ability to adequately assess the subrecipient?s risk of noncompliance and increases the risk of improper payments that the state may have to repay to the federal government. Recommendation: Management should utilize the LSUHSC-S audit requirement certification form to determine whether or not a subrecipient is required to receive a single audit and, if so, obtain and review those audits timely to determine the subrecipient?s risk of noncompliance. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-78).

2020-061 - Weakness in Controls with Special Tests and Provisions Requirements Award Year: 2019 Award Numbers: P20GM121307A, R25HL147665, R56AI132149 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2019-036) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LSUHSC-S did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. In a non-statistical sample of six federal R&D Cluster awards for the fiscal year ending June 30, 2020, from a population of 61 awards, three (50%) of the awards had documentation of the key personnel?s effort that did not agree to the effort reported to the federal grantor, and there was no evidence of prior approval from the federal grantor for change in key personnel. Criteria: 2 CFR 200.308(c) states that for non-construction federal awards, recipients must request prior approvals from federal awarding agencies for one or more of the following program or budget-related reasons: (i.) Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). (ii.) Change in a key person specified in the application or the Federal award. (iii.) The disengagement from the project for more than three months, or a 25% reduction in time devoted to the project, by the approved project director or principal investigator. Cause: Although LSUHSC-S has procedures in place for personnel to certify actual time and effort expended on federal awards, management has represented that additional training of department personnel is needed on how to appropriately complete the time and effort certification reports and plans to provide training were delayed due to COVID-19 office closures and telework. In addition, there are no procedures in place to use the time and effort certifications to monitor the effort of key personnel and verify that the principal investigator has obtained prior written approval from the federal grantor for changes in effort for key personnel. Effect: Failure to fully implement controls over key personnel requirements could result in noncompliance with Special Tests and Provisions requirements. Recommendation: Management should utilize the time and effort certifications to monitor changes in effort for key personnel and verify that prior written approval was obtained from the federal grantor for changes that exceed the thresholds in 2 CFR 200.308. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-80).

2019-005 - Noncompliance with Federal Procurement Standards at LSU A&M, the LSU Agricultural Center, and the Pennington Biomedical Research Center Award Years: 2015, 2017, 2018 Award Numbers: 2000322334, 2003905387, PGM103424D, RDK103860A, RGM127649A, S901128BAH, W9126G-18-2-0025 Compliance Requirement: Procurement and Suspension and Debarment Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Louisiana State University and Related Campuses (LSU), which includes LSU A&M, the LSU Agricultural Center (AgCenter), and the Pennington Biomedical Research Center (PBRC), did not ensure they were in compliance with federal procurement requirements for fiscal year 2019. Beginning on July 1, 2018, LSU was required to be in compliance with Uniform Guidance procurement standards set out in 2 CFR sections 200.318 through 200.326. LSU implemented a new internal federal procurement policy on July 1, 2018, to be in accordance with Uniform Guidance; however, the policy contained several exemptions to competitive solicitation allowed under the state University Pilot Procurement Code (UPPC) that are not considered exemptions per Uniform Guidance. This caused LSU A&M, the AgCenter, and PBRC to be noncompliant with federal procurement requirements. The following exceptions were noted: ? In a non-statistical sample of 39 LSU A&M federal Research and Development (R&D) Cluster procurement transactions from a population of 31,855 LSU A&M R&D procurement transactions subject to federal procurement requirements, four instances (10%) tested were not in compliance with federal procurement requirements during fiscal year 2019. ? In a non-statistical sample of 38 AgCenter federal R&D Cluster procurement transactions from a population of 8,429 AgCenter R&D procurement transactions subject to federal procurement requirements, two instances (5%) tested were not in compliance with federal procurement requirements during fiscal year 2019. ? In a non-statistical sample of 40 PBRC federal R&D Cluster procurement transactions from a population of 6,218 PBRC R&D procurement transactions subject to federal procurement requirements, one instance (3%) tested was not in compliance with federal procurement requirements during fiscal year 2019. Criteria: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR part 200. Cause: It was noted that the internal federal procurement policy contained competitive exceptions that were not in accordance with federal procurement standards in 2 CFR 200.318 through 200.326. These exceptions led to noncompliance with the federal purchase methods that included the micro-purchase methods. Effect: The exceptions resulted in total known questioned costs of $137,317 for all three campuses. LSU A&M?s exceptions resulted in $54,875 of known questioned costs, the AgCenter?s exceptions resulted in $32,442 of known questioned costs, and the PBRC?s exception resulted in $50,000 in known questioned costs. Failure to comply with the federal procurement standards resulted in noncompliance with federal regulations. Recommendation: LSU should ensure their federal procurement policies adhere to the federal procurement standards per 2 CFR 200.318 through 200.326 and that exemption letters are requested and obtained prior to following policies that do not comply with federal requirements. LSU has since obtained an exemption dated September 25, 2019 that allows them to increase the micro-purchase threshold to $50,000 in order to be consistent with state law and the UPPC. However, they should request exemptions for any other areas of conflict that may exist between 2 CFR 200.318 through 200.326 and their internal federal procurement policy. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-40).

2019-006 - Lack of Controls over Cash Management Requirements Award Years: 2018, 2019 Award Numbers: 186LA812Q2204, 186LA812Y8105, 196LA812Q2204, 196LA812Y8105 Compliance Requirement: Cash Management Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Louisiana Department of Agriculture and Forestry (LDAF) did not have controls in place over the federal funds drawdown process applicable to the cash management requirements of the Emergency Food Assistance Program ? Administrative Costs (CFDA 10.568). Criteria: 2 CFR 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: One employee was assigned the responsibilities of preparing and submitting the draw request for federal funds without an independent review. The procedures, as designed, would not detect errors or fraud that could occur when preparing the draw request. Effect: Failure to implement sufficient controls over cash management could result in LDAF requesting reimbursement for expenses not incurred prior to the request and place LDAF in noncompliance with federal regulations. Recommendation: LDAF should design and implement controls, such as a review and approval of federal drawdown requests prior to the request of funds, sufficient to ensure compliance with cash management requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-2).

2019-007 - Lack of Controls over Suspension and Debarment Requirements Award Years: 2018, 2019 Award Numbers: 186LA812Q2204, 186LA812Y8105, 196LA812Q2204, 196LA812Y8105 Compliance Requirement: Procurement and Suspension and Debarment Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDAF lacked controls to ensure compliance with regulations over the Food Distribution Cluster programs related to suspension and debarment requirements, including contracts and agreements with necessary compliance language. Criteria: 2 CFR ?180.300 requires participants entering into covered transactions with those at the next lower tier to verify that the person is not excluded or disqualified by checking System for Award Management (SAM) Exclusions; collecting a certification from that person; or adding a clause or condition to the covered transaction with that person. 2 CFR ?417.332 requires participants to include a term or condition in lower tier covered transactions requiring lower tier participants to comply with Subpart C of the OMB guidance in 2 CFR part 180 (2 CFR ?180.300 ? 2 CFR ?180.365). Cause: LDAF has not developed a method of ensuring participating food banks are not suspended or debarred. In addition, LDAF did not include a term or condition in contracts or agreements with participating food banks requiring participants to comply with federal suspension and debarment requirements. Effect: Failure to ensure that participating food banks are not suspended or debarred may result in noncompliance with federal regulations and increases the likelihood of disallowed federal funds that LDAF may be required to return to the federal grantor. Recommendation: LDAF should develop a method of ensuring participating food banks are not suspended or debarred. In addition, LDAF should include a term or condition in its updates to the food bank agreements requiring the food banks comply with federal suspension and debarment requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-3).

2019-008 ? Inadequate Grant Recovery of Homeowner Assistance Program Awards Award Years: 2006 - 2008 Award Numbers: B-06-DG-22-0001, B-06-DG-22-0002, B-08-DG-22-0003 Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2018-014) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2019, the Division of Administration (DOA), Office of Community Development (OCD), Disaster Recovery Unit (DRU) identified $155,000 in noncompliant Homeowner Assistance Program (HAP) awards for two homeowners through post-award monitoring for the Community Development Block Grant/State?s Program (CDBG). Because these noncompliant awards have not been recovered as of June 30, 2019, we consider the amounts as questioned costs. In addition, 28,547 noncompliant files totaling $962.7 million identified in previous years are still outstanding. Of this total, OCD is actively pursuing collections on 17,353 files totaling $621.9 million and the remaining 11,194 files totaling $340.7 million have been determined uncollectable for various reasons such as death or bankruptcy. As of June 30, 2019, $8.9 billion in total HAP awards have been disbursed to 130,053 homeowners. At year-end, OCD was actively reviewing files for 17 applicants totaling $591,000 identified as potentially noncompliant to make final determinations. In addition, OCD reported that the following progress was made during fiscal year 2019: 606 files were submitted to a law firm to pursue collection efforts; 129 applicants requested a plan for payment; and 354 files with obligations were paid off or were cleared. Criteria: Office of Management and Budget (OMB) Circular A-87, Cost Principles for State, Local, and Indian Tribal Governments, stipulates that for costs to be allowable for reimbursement by a federal program, the cost must be adequately supported and comply with all terms and conditions of the award and that the state (OCD) assume responsibility for administering federal awards in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to hurricanes Katrina and Rita, the state was awarded approximately $9.5 billion to administer HAP as part of the Road Home program, in accordance with its Action Plan approved by the U.S. Department of Housing and Urban Development (HUD). The state?s Action Plan stipulates that eligible homeowners must agree in legally-binding documents, referred to as covenants, to follow through on certain future actions in exchange for up to $150,000 in compensation for their damaged property. Funds are disbursed to the homeowner upon the effective date of signing the covenant, which is referred to as the closing date. Homeowners agree in the covenant to provide OCD with evidence that they will occupy their damaged property or replacement property within three years of the closing date, maintain homeowner?s insurance on their property, maintain flood insurance if necessary, and ensure that any required elevation conforms to the advisory base flood elevation regulation for the parish in which their home is located. The state?s Action Plan states that homeowners who fail to meet all of the program?s requirements may not receive benefits or may be required to repay all or some of the compensation received back to the program. Cause: In the initial stages of the program, OCD focused on making payments to disaster victims as quickly as possible, because the state had made a decision to accept additional risks associated with expedited payments with the understanding that any ineligible or unallowable payments would be detected and corrected in post-award monitoring. Awards are included in grant recovery because of duplication of benefits (homeowner?s insurance proceeds or other federal assistance), lack of documentation evidencing owner-occupancy of the property, and noncompliance with one or more award covenants. In addition, individual homeowner awards have been identified for grant recovery because of errors made by the program?s former contractor, ICF International Inc., in determining the grant calculation or obtaining the required documentation. In August 2015, HUD amended the grant terms and conditions to formalize a partnership between the state and HUD and created the Road Home closeout plan, which continues to address noncompliance. Additional opportunities allow for the review of awards to determine if any unmet needs or additional assistance is necessary for participants to return home, including reclassification of the Road Home Elevation Incentive award and allowing interim housing as an unmet need. OCD has forwarded noncompliant awards to a law firm for collection in accordance with the Road Home closeout plan. Effect: OCD?s failure to recover benefits from noncompliant homeowners could result in disallowed costs. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of these awards. Recommendation: OCD should continue its recovery efforts to collect those awards determined to be noncompliant. Management?s Response and Corrective Action Plan: OCD?s response indicates concurrence with the finding stating that OCD will continue its efforts to recover those awards determined to be ineligible in accordance with policies and procedures that are acceptable to HUD. OCD?s response also indicates that OCD will continue to work with homeowners to become compliant and resolve grant compliance issues in order to reduce or eliminate the need to recapture funds from homeowners where appropriate (B-8).

2019-009 - Inadequate Recovery of Small Rental Property Program Loans Award Years: 2006, 2007 Award Numbers: B-06-DG-22-0001, B-06-DG-22-0002 Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2018-015) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fiscal year ended June 30, 2019, the DOA, OCD-DRU identified $7,585,337 in Small Rental Property Program (SRPP) loans for 85 property owners under the Community Development Block Grants/State?s Program (CDBG, CFDA 14.228) who failed to comply with one or more of their loan agreement requirements and were assigned to loan recovery status. Since OCD has not recovered these loans, we consider these amounts totaling $7,585,337 to be questioned costs. Of the $7.6 million, OCD reported that loans totaling $1.1 million for 16 borrowers have been determined uncollectable for various reasons such as foreclosure, property seizure, or legal dispute. In addition, 922 noncompliant loans identified in previous years totaling $81.3 million remain outstanding. Of this total, OCD is actively pursuing collections on 778 loans totaling $68.7 million. The remaining $12.6 million is for noncompliant loans that OCD has determined uncollectable for the same reasons noted previously. As of June 30, 2019, of the 4,489 outstanding SRPP loans totaling $438.6 million, 847 noncompliant loans totaling $75.2 million are in active recovery status, and OCD represented that current recovery efforts are to either recoup the loan funds or work with the applicants to bring them into compliance with the state?s continuing requirements of the program. In addition, 153 noncompliant loans totaling $13.8 million have been determined by OCD to be uncollectable. Criteria: OMB Circular A-87, Cost Principles for State, Local, and Indian Tribal Governments, stipulates that the state (OCD) assume responsibility for administering federal awards in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. In response to hurricanes Katrina and Rita, the state was awarded and has allocated approximately $653 million to the SRPP, as part of the Road Home program. In accordance with the state?s HUD-approved Action Plan Amendment 24, the SRPP offers forgivable loans to qualified property owners who agree to offer rental properties at affordable rents to be occupied by lower-income households. In exchange for accepting loans ranging between $10,000 and $100,000 per rental unit, property owners are required to accept limitations on rents and incomes of renters during an ?affordability period,? a specified period of time based on the amount of funding received and the type of work being done (renovation or full construction) ranging between three and 20 years. The loan amounts are determined based on location of property, number of bedrooms, and the poverty level of the renter. In addition to accepting limitations on rents and income of renters, property owners also agree to maintain property insurance and maintain flood insurance, if necessary. These requirements become effective one year after the closing date and remain until the expiration of the ?affordability period.? According to the loan agreements, failure to comply with any of the loan requirements shall constitute default and mandatory repayment. Good internal controls would ensure that policies and procedures are in place with an established timeline to monitor compliance with the loan agreements and provide for specific actions (i.e., loan modification, foreclosure, or repayment) if a property owner fails to comply with the loan agreement or does not provide evidence of compliance as required by the loan agreement. Cause: In June 2016, HUD issued a monitoring review report that included a finding that states the SRPP design lacked sufficient fiscal accounting controls and procedures to ensure that CDBG funds identified as ineligible expenses are able to be recaptured and repurposed for eligible uses. In HUD?s May 2017 monitoring report, HUD noted that Louisiana had made significant progress on reviewing the SRPP documentation and implementing the corrective actions described in the June 2016 monitoring report. In HUD?s May 2018 and March 2019 monitoring reports, HUD reported that OCD would continue to use tools available to bring the noncompliant applicants into compliance and take recovery action against those that are unable to become compliant. OCD will continue to update HUD quarterly on progress towards resolving the finding. Effect: Ultimately, OCD?s failure to recover loans from noncompliant property owners could result in disallowed costs. The state could be liable for noncompliant awards if disallowed by the federal grantor; however, it is unknown whether the federal government would demand repayment of the awards. Recommendation: OCD should continue its monitoring to identify awards to be placed in recovery and continue the corrective actions as recommended by HUD to recover funds from noncompliant property owners. Management?s Response and Corrective Action Plan: OCD stated in its response that it will continue the efforts to recover ineligible awards and will continue to work with rental property owners to become compliant and resolve loan compliance issues to reduce or eliminate the need to recapture funds from rental property owners (B-10). Auditor?s Additional Comment: OCD?s response notes that those files determined to have satisfied a HUD National Objective, but not the state?s continuing program requirements, are not subject to repayment to HUD. However, OCD could not provide communications from HUD supporting this statement. Therefore, we continue to identify these files as questioned costs.

2019-010 - Inadequate Source Code Escrow Agreement Award Year: Not applicable Award Number: Not applicable Compliance Requirement: Other Repeat Finding: Yes (Prior Year Finding No. 2018-019) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive audit, the Louisiana Workforce Commission?s (LWC) contract with Geographic Solutions, Inc. (GSI) lacks an adequate source code escrow agreement that would allow LWC to continue operations of the Unemployment Insurance (UI) program if GSI can no longer provide services. Although LWC amended its contract with GSI in fiscal year 2018 to address problems noted during a previous audit, the amended contract does not address the infrastructure and other systems that the Helping Individuals Reach Employment (HiRE) system?s source code requires for execution. During fiscal year 2018, LWC drafted an addendum to this contract whereby HiRE will duplicate to another location for LWC?s use as a working copy in the event of GSI default. However, GSI has not signed this addendum. Criteria: Good internal controls over information technology contracts should ensure the inclusion of certain key terms in an executed agreement including a source code escrow clause that would protect the entity upon contractual default of the contractor. Cause: GSI has not signed the addendum to the contract. Effect: LWC may be unable to use the source code in the event of GSI?s contractual default. Recommendation: Management should continue to seek GSI?s acceptance of the addendum that establishes a complete escrow arrangement. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-45).

2019-011 - Noncompliance with Subrecipient Monitoring Requirements Award Years: 2016 - 2019 Award Numbers: AA-28319-16-55-A-22, AA-30955-17-55-A-22, AA-32201-18-55-A-22, AA-32232-19-55-A-22 Compliance Requirement: Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LWC did not adequately monitor subrecipients under the Workforce Innovation and Opportunity Act (WIOA) Cluster programs. WIOA program expenditures totaled $39 million during fiscal year 2019, with approximately $36 million provided to subrecipients who were not adequately monitored. Audit procedures identified the following: ? LWC did not conduct timely annual on-site monitoring reviews of its subrecipients for compliance with federal laws and regulations. During fiscal year 2019, on-site reviews were conducted for only five of the 15 subrecipients and these reviews related to fiscal year 2017 program activity. ? LWC did not ensure that required audits were completed within nine months of the subrecipient?s fiscal year-end. Although LWC requested subrecipients to provide the required audits, documentation showed that nine of the 15 subrecipients? audits were received between 39 and 220 days after the due date. Criteria: 20 CFR ?667.410(b)(2) and (b)(3) requires that LWC?s monitoring system provide for annual on-site monitoring reviews of its subrecipients? compliance with the federal uniform administrative requirements and include reviews of its subrecipients? fiscal and administrative functions. 2 CFR ?200.331(f) states that pass-through entities are responsible for ensuring that subrecipients expending $750,000 or more in federal awards during the subrecipient?s fiscal year, meet the audit requirements of 2 CFR Part 200, subpart F. 2 CFR ?200.512 states that required audits are completed within nine months of the end of the subrecipient?s audit period. Cause: LWC management indicated there was a significant turnover in personnel that did not allow them to perform adequate subrecipient monitoring. Effect: Failure to perform adequate monitoring impairs LWC?s ability to ensure that program funds passed through to its subrecipients are spent in accordance with program regulations and increases the risk of improper payments that the state may have to repay to the federal government. Recommendation: LWC management should ensure that annual on-site monitoring reviews are performed for all subrecipients as required by federal regulations. In addition, management should ensure all required audits are received in a timely manner. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-46).

2019-012 - Weak Security Controls Award Year: Not applicable Award Number: Not applicable Compliance Requirements: Activities Allowed or Unallowed, Eligibility, Reporting, Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2018-020) See Schedule of Findings and Questioned Costs for chart/table Condition: LWC did not have adequate security controls over the Louisiana Wage and Tax System (LaWATS) and the UI mainframe. LaWATS is a portal that allows employers to enter wages, and it interfaces with the UI mainframe, which contains employment tax records. Both systems are utilized for the UI program. Our audit procedures revealed the following: ? LWC has not established responsibilities for monitoring the Office of Technology Services (OTS) employees with access to the operating systems and databases for LaWATS and the UI mainframe to ensure they have a valid business need. Without adequate monitoring, LWC may be unable to detect unauthorized user access to LaWATS and the UI mainframe. ? Other information relating to security access was not included in this report due to the sensitive nature of the issues. This information has been separately communicated to LWC. Criteria: Adequate information technology controls include protecting information to maintain the level of information security risk acceptable to the organization in accordance with the security policy and performing security monitoring. Cause: LWC has not established responsibilities for monitoring OTS employees with access to the operating systems and databases for LaWATS and the UI mainframe to ensure they have a valid business need. Effect: Inadequate security of LWC?s systems may lead to unauthorized view or theft of unemployment insurance and tax data, or noncompliance with privacy laws. Recommendation: LWC should establish responsibility for regular monitoring of OTS employees with access to LaWATS and the UI mainframe. Management?s Response and Corrective Action Plan: Management concurred with the finding and outlined a plan of corrective action (B-47).

2019-013 - Inadequate Controls Related to Highway Planning and Construction Cluster Quality Assurance Requirements Award Years: 2006, 2012, 2014 - 2018 Award Number: Not applicable Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Transportation and Development (DOTD) did not have adequate controls in place to ensure that documentation relating to its quality assurance program was completed timely for projects of the Highway Planning and Construction Cluster (HPCC). DOTD?s Construction Contract Administration Manual requires the Summary of Samples and Test Results (Form 2059) to be submitted within 30 days of final acceptance of the project. However, in practice, DOTD requires Form 2059 to be submitted within 90 days of final acceptance. The Summary of Samples and Test Results is certified by applicable engineers and includes documentation relating to the quality of materials used for the project, including the sampling plans and test results of the materials. In a statistical sample of 19 federal projects reviewed from a population of 200 projects receiving final acceptance in fiscal year 2019, DOTD did not ensure Form 2059 was completed within 90 days for eight projects (42%), ranging from 93 to 329 days after final acceptance. In addition, there was one individually important project reviewed where Form 2059 was completed 393 days after final acceptance. Criteria: 23 CFR ?637.205(a) requires that state transportation departments develop a quality assurance program which will assure that the materials and workmanship incorporated into each federal-aid highway construction project are in conformity with the requirements of the approved plans and specifications. Cause: DOTD did not adequately track projects receiving final acceptance to ensure timely submission of Form 2059. Effect: Failure to timely complete the Summary of Samples and Test Results increases the risk that the sampling and testing were not in accordance with DOTD?s quality assurance program, which could result in substandard materials and workmanship used on a project. Recommendation: DOTD should actively track projects receiving final acceptance to ensure Form 2059 is submitted within 90 days. Additionally, DOTD should update its Construction Contract Administration Manual and other applicable policies regarding the deadline of Form 2059 to reflect actual procedures. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-57).

2019-014 - Noncompliance and Inadequate Controls Related to Highway Planning and Construction Cluster Subrecipient Monitoring Award Years: 2006, 2010, 2013, 2015 - 2016, 2018 Award Number: Not applicable Compliance Requirements: Procurement and Suspension and Debarment, Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: DOTD did not adequately monitor subrecipients of the HPCC programs. Audit procedures resulted in the following: ? DOTD did not obtain payment documentation in a timely manner from certain subrecipients receiving funds on a ?cost disbursement? basis. From a population of 814 payments made to subrecipients totaling $52,531,691 in fiscal year 2019, a statistical sample of 48 payments were reviewed, 20 of which were advance payments to ?cost disbursement? subrecipients. Prior to inquiry by the auditor in September 2019, DOTD had not obtained proof of payment for $668,826 related to two (10%) advance payments, one of which was paid to a subrecipient in July 2018 and another subrecipient who was paid in October 2018. In addition, subsequent payments were made by DOTD to these two subrecipients without having proper documentation for the previous advance payments, which conflicts with DOTD policy. The proof of payments were later obtained and reviewed by DOTD after inquiry by auditor. ? DOTD did not adequately evaluate subrecipients? risk of noncompliance, which includes evaluating whether subrecipients have sufficient accounting controls to properly manage federal funds. The evaluation of subrecipients is to be used for the purpose of determining the appropriate subrecipient monitoring related to the subaward. In a non-statistical sample of 10 subrecipients selected from a population of 55 subrecipients with payments from DOTD in fiscal year 2019, two of the subrecipients reviewed did not have documentation that a risk assessment was performed, while one subrecipient?s last risk assessment was performed in April 2017. This resulted in DOTD not properly evaluating the risk of three (30%) subrecipients. In addition, DOTD does not evaluate the risk of state subrecipients, only non-state subrecipients. ? DOTD did not have adequate controls in place to ensure that subrecipients were not suspended or debarred prior to the subaward. In a non-statistical sample of 10 subrecipients selected from a population of 55 subrecipients with payments from DOTD in fiscal year 2019, two (20%) of the subrecipients reviewed did not have documentation of DOTD verifying that the subrecipient was not suspended or debarred. Based on the results of our procedures to identify any suspended or debarred subrecipients, none were noted. ? DOTD did not have adequate controls in place to ensure that required audits were completed within nine months of the subrecipient?s fiscal year end. In a non-statistical sample of 10 subrecipients selected from a population of 55 subrecipients with payments from DOTD in fiscal year 2019, there was no documentation that two (20%) of the subrecipient audit reports were reviewed or that management decisions were issued for any findings to ensure timely and appropriate corrective action by subrecipients. Criteria: Payments made on a ?cost disbursement? basis are sent to subrecipients based on invoices for goods or services, prior to the subrecipients actually paying for the goods or services. DOTD?s policy requires that these ?cost disbursement? subrecipients provide proof of payment for those invoiced goods and/or services within 60 days of receipt of funds from DOTD. 2 CFR ?200.331(d) requires that pass-through entities monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. 2 CFR ?200.331(b) requires that pass-through entities evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring of the subrecipient. Further, 23 USC 106(g)(4)(A) requires that states are responsible for determining that subrecipients have sufficient accounting controls to properly manage federal funds. 2 CFR ?180 requires that non-federal entities verify, prior to making a subaward, that the subrecipient is not debarred, suspended, or otherwise excluded from or ineligible for participation in the federal program. 2 CFR ?200.331(f) and 2 CFR ?200, Subpart F, require that pass-through entities ensure subrecipients expending $750,000 or more in federal awards during the subrecipient?s fiscal year are audited as required by 2 CFR ?200, Subpart F, and that the required audits are completed within nine months of the end of the subrecipient?s audit period. In addition, 2 CFR ?200.331(d)(2) and (3) require pass-through entities to issue a management decision on applicable audit findings within six months after receipt of the subrecipient?s audit report and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. Cause: DOTD has not developed a centralized method of tracking subrecipient monitoring activities, such as tracking subrecipients who receive advance payments to ensure payment documentation is later provided, tracking new subrecipients to ensure risk assessments are performed, and to ensure subrecipients are not suspended or debarred. In addition, DOTD?s subrecipient risk assessment process involves several different sections within DOTD, and there is not an overall policy outlining the responsibility of each section. For subrecipient audit reports, DOTD is not ensuring completeness of the LaGov expenditure report utilized in determining which subrecipients require an audit in addition to not considering if those expenditures were incurred in the subrecipient?s fiscal year. Effect: Failure to properly monitor subrecipients may result in noncompliance with federal regulations and increases the likelihood of disallowed federal funds that DOTD may have to return to the federal grantor. However, we noted no questioned costs. Recommendation: DOTD should develop a centralized method of tracking subrecipients for advance payment review to ensure all necessary documentation is obtained from subrecipients receiving cost disbursements within the required 60-day timeframe and should retain necessary documentation to support policy adherence. DOTD should also create an overall subrecipient risk assessment policy which outlines the responsibility of each section and develop a tracking mechanism to ensure risk assessments are performed and documented on all subrecipients, including state subrecipients, to determine the appropriate level of monitoring. In addition, DOTD should implement procedures to verify that subrecipients are not suspended or debarred at the time of subaward. Finally, DOTD should strengthen controls to ensure the review of all required subrecipient audit reports are obtained and reviewed timely. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-59).

2019-015 - Noncompliance with and Inadequate Controls over Federal Special Tests and Provisions Requirements at LSU A&M and the LSU Agricultural Center Award Year: 2018 Award Number: NASA (2018-21)-Research-MGT-12 Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2018-009) See Schedule of Findings and Questioned Costs for chart/table Condition: LSU A&M, for the second consecutive year, did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. In a non-statistical sample of 21 LSU A&M federal R&D Cluster awards from a population of 718 LSU A&M awards subject to special tests and provisions, LSU A&M records for one (5%) of the awards tested did not contain evidence that the key personnel requirements applicable were met during fiscal year 2019. In addition, for the third consecutive year, the AgCenter did not have adequate controls over Special Tests and Provisions. Criteria: 2 CFR 200.308(c)(i)-(iii) states that for non-construction federal awards, recipients must request prior approvals from federal awarding agencies for one or more of the following program or budget-related reasons: (i.) Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). (ii.) Change in a key person specified in the application or the federal award. (iii.) The disengagement from the project for more than three months, or a 25 percent reduction in time devoted to the project, by the approved project director or principal investigator. Cause: In fiscal year 2019 LSU A&M and the AgCenter, in following their corrective action plan from fiscal year 2018, began the process of establishing a system-based control over key personnel requirements that went live in April 2019. This control allows analysts to track key personnel time and effort by budget period under the award. Since the control was implemented late in fiscal year 2019, LSU A&M and the AgCenter were unable to input time and effort information for all awards. According to the fiscal year 2018 corrective action plan for LSU A&M and the AgCenter, the new control will be fully implemented by June 30, 2020. Effect: Failure to fully implement controls over key personnel requirements could result in noncompliance with Special Tests and Provisions requirements. Recommendation: LSU A&M and the AgCenter should ensure the new control over key personnel requirements is fully implemented and that it effectively determines if they follow key personnel requirements and ensures they obtain any required federal awarding agency approval for changes. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided an update on its corrective action (B-39).

2019-016 - Overpayment of Student Financial Assistance Award Years: 2016 - 2020 Award Numbers: P038A131668, P063P161524, P063P171524, P063P181524, P063P191524, P268K171524, P268K181524, P268K191524, P268K201524 Compliance Requirement: Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Southeastern Louisiana University (Southeastern) did not have a process in place to determine if students were eligible to receive student financial assistance, resulting in noncompliance with federal regulations. Using Institutional Student Information Reports (ISIR), we identified a population of 347 students who may have exceeded or were close to exceeding the aggregate loan limits during the period July 1, 2016, through December 31, 2019. Our review disclosed that 94 students with subsidized and unsubsidized loans were allowed to borrow $552,647 in excess of the aggregate loan limits for Federal Direct Student Loans. In addition, some of these students incorrectly received payments totaling $34,123 in Federal Pell grants and $3,000 in Federal Perkins Loans. As of the completion of fieldwork, Southeastern had returned $29,898 to the U.S. Department of Education due to the noncompliance. Criteria: 34 CFR 685.203 (d) and (e) sets the aggregate limits for subsidized loans ($23,000 ? undergraduate and $65,500 ? graduate or professional student) and the aggregate limits for unsubsidized loans (dependent students - $31,000 minus any Direct Subsidized Loan and Subsidized Federal Stafford Loan amounts; independent students or dependent with denied Parent Plus Loan - $57,500 minus any Direct Subsidized Loan and Subsidized Federal Stafford Loan amounts; graduate/professional students - $138,500 including loans for undergraduate studies minus any Direct Subsidized Loan and Subsidized Federal Stafford Loans amount). 34 CFR 668.32(g)(2) states a student is not eligible to receive funds under any of the Title IV student aid programs if the student has received Title IV loan funds in excess of applicable statutory loan limits. 34 CFR 668.35(d) specifies actions that a student who has inadvertently exceeded an annual or aggregate loan limit may take to regain Title IV eligibility by reaffirming the outstanding debt or by making satisfactory repayment arrangements. When reaffirming excess borrowing, an institution must determine that a borrower?s receipt of loan funds in excess of an annual or aggregate loan limit was inadvertent before the borrower may regain Title IV eligibility. Good internal controls require the university to review students? payment information to ensure that students will not exceed the annual or aggregate loan limits in determining if students are eligible for Federal Direct Loans, are not in default, and do not owe an overpayment on a Title IV grant or loan. Cause: Southeastern's financial aid staff did not upload the appropriate files from the National Student Loan Data System (NSLDS) into PeopleSoft causing the information related to aggregated loan amounts to be inaccurate. Also, counselors did not have a general understanding of ISIR codes and how to review information in the PeopleSoft Student module and in NSLDS. Effect: Failure to determine eligibility status prior to awarding loans or grants may result in noncompliance with federal regulations and increases the likelihood of disallowed federal funds that Southeastern may be required to return to the federal grantor. Recommendation: Southeastern should design and implement controls to ensure that students are eligible for all financial assistance received. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided an update on its corrective action (B-54).

2019-017 - Noncompliance and Weakness in Controls Related to Federal Equipment Management Regulations Award Year: 2019 Award Number: P031B170079 Compliance Requirement: Equipment and Real Property Management Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Southern University at Baton Rouge (SUBR) did not fully comply with federal equipment management regulations for the Higher Education Institutional Aid program (Title III) relating to the identification of equipment in the inventory system by federal award. SUBR provided a master inventory listing of Title III equipment including 942 items totaling $2,755,246. Audit procedures to determine completeness of the listing revealed that 3 (30%) of 10 Title III equipment items reviewed were not identified in the inventory listing as federal equipment. Criteria: 2 CFR 200.313(d)(1) requires that property records must be maintained including information regarding the source of funding for the property as well as the federal award identification number. Cause: SUBR does not have procedures in place to document the federal award used to purchase the equipment in the inventory system. Effect: SUBR cannot ensure compliance with federal equipment management regulations. Recommendation: SUBR management should design and implement internal controls to ensure that federal equipment is properly identified in the inventory system and managed. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-56).

2019-018 - Control Weakness over Foster Care Payments Award Years: 2018, 2019 Award Numbers: 1801LAFOST, 1901LAFOST Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Children and Family Services (DCFS) had weakness in controls over Foster Care payments that related to the accuracy of monthly payments made to foster families and expenditure coding. In a non-statistical sample of 120 transactions totaling $114,643 from a population of 51,332 expenditure transactions totaling $19.9 million, three errors (3%) were identified. Two monthly payments to foster families were underpaid by six and nine days, and one miscellaneous expenditure was incorrectly coded. Criteria: Per DCFS policy Chapter 6, Section 1605 Board Payments for Foster Children, the placement authorization has a beginning and end date which the system uses to automatically generate a payment on a monthly basis. The authorization can be extended in the month it expires by changing the end date of the existing service authorization to the new end date. Per 2 CFR 200.403(b), in order to be allowable, costs must conform to any limitations or exclusions set forth in the federal award as to types or amount of cost items. Cause: DCFS personnel did not follow established policy to change the service authorization dates to extend to the last day of placement. In addition, an error was made when entering the expenditure coding into the system. Effect: Failure to enter correct placement end dates into the system could result in over or under payments to foster care providers and increases the risk of questioned costs. Miscoding expenditures can result in unallowable costs being charged to the program. Recommendation: DCFS should follow established policies and procedures to ensure payments to foster families and miscellaneous expenditures are for accurate periods and for allowable costs. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-4).

2019-019 - Noncompliance and Control Weakness Related to the Temporary Assistance for Needy Families Work Verification Plan Award Years: 2018, 2019 Award Numbers: 1801LATANF, 1901LATANF Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: DCFS did not ensure that all work-eligible cash assistance recipients were engaged in work activities and that supporting documentation was maintained for hours worked under the Temporary Assistance for Needy Families (TANF) cluster of programs. In a non-statistical sample of 60 out of 21,126 work activity records in the job-tracking system for approximately 2,000 clients per month, 11 (18%) work-eligible participants either had no work activity hours reported in the job-tracking system or did not have adequate supporting documentation of work activities as required by federal regulations. DCFS has a contract with LWC and paid $1.9 million to LWC during fiscal year 2019 to perform case management services, including ensuring participants are engaged in a minimum of 30 hours per week of work activities, and documenting work activity in the job-tracking system. However, based on our audit procedures, LWC did not comply with contract requirements. Criteria: 45 CFR 261.10 (a)(1) states, in part, a parent or caretaker receiving assistance must engage in work activities when the state has determined that the individual is ready to engage in work. Per 45 CFR 261.61 (a), a state must support each individual?s hours of participation through documentation in accordance with its Work Verification Plan. Per 45 CFR 261.65 (a)(2) and 45 CFR 262.1 (a)(15), if determined that the state has not maintained adequate documentation, verification, or internal control procedures to ensure the accuracy of the data used in calculating the work participation rates, the federal grantor could impose a penalty to the state of not less than 1% and not more than 5% of the adjusted state Family Assistance Grant. Per the contract between DCFS and LWC, LWC will provide case management services to work eligible cash assistance recipients. These services include conducting a comprehensive assessment and developing an individualized employment plan known as the Family Success Agreement (FSA). Case managers must monitor the participant?s compliance with the FSA and document work activities in the DCFS job-tracking system. Cause: DCFS?s ongoing monitoring of LWC has not resulted in LWC?s compliance with all contract terms and federal requirements. Effect: The federal grantor could assess the state penalties totaling not less than 1% and not more than 5% of the $111 million adjusted grant award based on the exceptions noted; however, the likelihood of such an assessment is unknown. Recommendation: DCFS should ensure LWC documents the TANF clients? work activities and that contracted case management services are being provided to meet program objectives and comply with federal program requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-5).

2019-020 - Noncompliance and Control Weakness Relating to Foster Care Subrecipient Monitoring Award Years: 2018, 2019 Award Numbers: 1801LAFOST, 1901LAFOST Compliance Requirement: Subrecipient Monitoring Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: DCFS did not adequately review subrecipient Foster Care invoices to ensure reimbursements were made in accordance with approved contract rates and only included allowable dates of service. A statistical sample of 10 invoices paid by DCFS from a population of 125 subrecipient invoices totaling $3,811,697, disclosed the following for five (50%) Office of Juvenile Justice (OJJ) maintenance invoices of which one invoice had more than one error: ? For one invoice, the daily rate billed for two residential facilities did not agree to the contract rate, resulting in overpayments of $2,426. ? For one invoice, OJJ paid the residential facility for 28 days but billed DCFS for 29 days, resulting in an overpayment of $92. This same invoice had an additional error related to the supervision rate as explained below. ? For four invoices, OJJ paid residential facilities the enhanced supervision rate for certain residents but billed DCFS at the basic supervision rate. This resulted in an underpayment of $9,188. Due to the exceptions noted above, additional procedures were performed on the remaining six OJJ maintenance invoices paid in fiscal year 2019, some of which had more than one error. Audit procedures disclosed the following: ? For two invoices, the daily rate billed for two residential facilities did not agree to the contract rate, resulting in overpayments of $2,483. ? For one invoice, OJJ billed DCFS for 11 days that had been previously reimbursed, resulting in an overpayment of $1,016. ? For one invoice, OJJ paid the residential facility for 27 days but billed DCFS for 28 days, resulting in an overpayment of $92. ? For six invoices, OJJ paid residential facilities the enhanced supervision rate for certain residents but billed DCFS at the basic supervision rate, resulting in an underpayment of $12,312. Criteria: 2 CFR 200.331 (d) requires that pass-through entities monitor the activities of subrecipients as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Per DCFS?s contract with OJJ related to the Foster Care program, DCFS agrees to receive, review, and certify expenditure reports for Foster Care expenditures. Cause: These conditions occurred because of a weakness in controls in monitoring Foster Care subrecipient reimbursements. Effect: Failure to properly review invoices resulted in over and under reimbursements and could result in disallowed costs by the federal grantor. In total, there were $6,109 in overpayments considered questioned costs and $21,500 in underpayments. Recommendation: DCFS program management and subrecipient contract monitors should follow the established DCFS payment methodology and ensure subrecipients are only reimbursed for eligible days, as well as the established daily and supervisions rates. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-6).

2019-021 - Noncompliance and Control Weakness Relating to the Temporary Assistance for Needy Families Income Eligibility Verification Award Years: 2018, 2019 Award Numbers: 1801LATANF, 1901LATANF Compliance Requirements: Activities Allowed or Unallowed, Eligibility, Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: DCFS did not review income information obtained through the data exchange system to determine the effect on the recipient?s eligibility for cash benefits under the TANF cluster of programs. In a non-statistical sample of 60 client payments from a population of 59,563 client payments totaling $16,671,134, two (3%) client files did not show the income summary reviewed and amounts included in the eligibility calculation. Criteria: Per 45 CFR Section 205.55 A(a)(1), the state agency will request wage information through an income and eligibility verification system for all applicants. Per 45 CFR Section 205.56 (A)(a)(1)(i), the state agency shall review and compare the information obtained from each data exchange against information contained in the case record to determine whether it affects the applicant?s or the recipient?s eligibility or the amount of assistance. Per DCFS policy B-632, Documentation of Income, the Clearance Summary (data exchange) must be checked to verify the reported household income information. Cause: Case workers did not follow DCFS policy and federal regulations to review and compare information obtained from the data exchange with information contained in the case records to verify the client?s eligibility. Effect: These exceptions increase the risk that clients may receive benefits to which they are not entitled and could result in DCFS having to repay the funds to the federal grantor. One of the clients related to the exceptions noted received $2,664 in benefits but was only eligible for $1,464, resulting in a questioned cost of $1,200. Recommendation: Because of the exceptions noted in a program that disbursed approximately $18 million in cash benefits during fiscal year 2019, DCFS should ensure its case workers follow established policy and use the information obtained from the data exchange to verify client eligibility. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-7).

2019-022 ? Inadequate Controls over Billing for Behavioral Health Services Award Years: 2016 - 2019 Award Numbers: 1605LA5MAP, 1705LA5021, 1705LA5MAP, 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: In a Medicaid Audit Unit report, Improper Billing of Services within the Medicaid Behavioral Health Program, issued September 4, 2019, we identified approximately $47.5 million in encounters and claims for services between December 2015 and June 2019 that were paid by the Louisiana Department of Health (LDH), the managed care organizations (MCOs), and Magellan Health Services (Magellan) even though claims did not comply with the LDH coding requirements and fee schedule. The billing errors could be avoided by LDH, the MCOs, and Magellan applying system edits that would deny claims and encounters when billing and fee schedule requirements are not followed. The report identified the following instances of billing errors: ? Providers were paid $38,533,711 for 646,746 encounters and claims that were billed using incorrect procedure and modifier codes. Without the required modifiers, the claim or encounter does not contain enough information to determine that the billing was appropriate. ? Providers were paid $9,044,773 more than indicated on the LDH fee schedule for 647,910 encounters and claims for behavioral health services. For the amount noted above, the MCOs confirmed that they did not have alternative fee schedules. ? Providers were paid $7,800 for 322 encounters and claims for improperly billed add-on behavioral health services. For the amount noted above, add-on services were paid without the required primary service. Criteria: LDH?s fee schedule outlines procedure codes for services and the applicable billing rates. Some services require that procedure codes also contain modifier codes which indicate information such as the age of the recipient, location where the service was provided, the educational background of the person providing the service, and the license(s) they have obtained. The LDH fee schedule outlines different rates depending on the procedure code and modifier codes. The MCOs can optionally pay more than the minimum LDH fee schedule. However, LDH does not currently maintain a list of these providers and therefore cannot determine if a claim paid at an excessive rate was improperly billed. According to MCO guidance to providers, add-on services are reimbursable when provided in addition to the appropriate primary service performed by the same provider and cannot be billed as standalone services. Cause: LDH, the MCOs, and Magellan did not have adequate controls in place to ensure that behavioral health services in the Medicaid program were properly billed and that improper encounters and claims were denied. Effect: While a majority of the errors were MCO encounters, 102,889 of the errors were fee-for-service claims totaling $2,166,422 ($1,429,611 federal funds and $736,811 state funds), which are considered questioned costs. It is important that encounter data is accurate because LDH and other stakeholders, such as the Medicaid Fraud Control Unit within the Attorney General?s Office, use this data to identify improper payments and potential fraud. LDH also uses this encounter data to establish per member per month rates for the MCOs. Recommendation: LDH management should implement adequate internal controls to ensure that claims and encounters are coded correctly, which could include edit checks to deny improper billings. Management?s Response and Corrective Action Plan: Management did not concur with the recommendation providing that the recommendation is inconsistent with a risk-based managed care model (B-14). Auditor?s Additional Comments: According to four of the five MCOs and Magellan, contracted providers are required to follow LDH?s fee schedule. In addition, both of the MCOs who were sent examples of the issues identified in the Medicaid Audit Unit report Improper Billing of Services within the Medicaid Behavioral Health Program agreed that the examples were errors. If MCO edit checks were working appropriately, these claims should have been denied. Although LDH has procedures to monitor on a post-payment basis, edit checks are important for ensuring encounter data is accurate and for ensuring only valid claims are paid. In addition, LDH has established edit checks which deny claims with invalid or missing modifier codes for other types of services such as physician claims and emergency medical transportation. Therefore, establishing edit checks to deny specialized behavioral health claims with invalid or missing modifiers should be consistent with a risk-based managed care model.

2019-023 - Inadequate Controls over Healthy Louisiana Premium Payments Award Years: 2018, 2019 Award Numbers: 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH did not have adequate controls in place to ensure proper coding of all managed care premiums, resulting in Healthy Louisiana premium payments made to the managed care health plans that did not match the correct recipient eligibility type. In November 2019, LDH acknowledged the mismatched premiums and made corrections to 518 Healthy Louisiana premiums paid for service dates July 2016 through September 2019. The correction resulted in a net recoupment of approximately $176,000 from the managed care health plans. LDH is working to correct an additional 419 premium payments. LDH made $7.9 billion dollars in Healthy Louisiana premium payments in fiscal year 2019. While the mismatched premium payments noted above are immaterial in relation to the total amount paid, LDH must ensure premium payments are supported by recipient eligibility. Criteria: LDH?s fiscal intermediary makes monthly premium payments to the Healthy Louisiana managed care health plans based on capitation codes and rates established by LDH?s actuary. The capitation codes and rates are specific to a recipient?s eligibility type in the Medical Assistance Program (CFDA 93.778, Medicaid), and Children?s Health Insurance Program (CFDA 93.767, LaCHIP). Premium payments should be based on a recipient?s eligibility for the month of service. Cause: Based on discussions with LDH, some of the mismatched premiums occurred due to changes in recipient eligibility. LDH is still researching additional causes but does expect mismatched premium payments to occur. According to LDH, modifications are being made to its monthly adjustment processes to correct the payments. Effect: When a recipient?s eligibility for a month does not correspond to the capitation code and rate paid to the managed care plan for that month, the premium coding is considered mismatched and the payment improper. Recommendation: LDH should identify the causes for all existing mismatched premium payments. LDH should also establish controls to ensure premium payments are made based on recipient eligibility and ensure timely adjustment when premium payments do not match eligibility due to eligibility changes after the payment. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-16).

2019-024 - Inadequate Controls over Medicare Buy-In Award Year: 2019 Award Number: 1905LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH failed to correct errors and update information on recipient eligibility records for variances reported to LDH by the Centers for Medicare and Medicaid Services (CMS), resulting in LDH not paying appropriate Medicare Buy-In (Buy-In) premiums to CMS for Medicare coverage for eligible recipients. Criteria: Under the Louisiana Medicaid State Plan, the state enrolls certain Medicare eligible recipients in Medicare and pays the premiums associated with their Medicare coverage under the Medicaid program. The payments are made under the Buy-In program with payments to CMS occurring monthly for Medicare Part A and/or Part B. Medicare Part A helps to pay for the cost of inpatient hospital care, while Part B covers outpatient medical services. In some cases, recipients are enrolled in both Part A and Part B Buy-In. In calendar year 2019, Part A premiums were $437 per month, with LDH paying for approximately 8,900 recipients each month. Part B premiums were $135 per month, with LDH paying for approximately 207,000 recipients each month. LDH recipient data and CMS recipient data for Buy-In eligible recipients must match in order to ensure appropriate Buy-In premium payments and proper handling of medical service claims. Cause: Prior to November 2018, using data from CMS, LDH generated monthly reports to identify variances between the CMS data and LDH data. These variances could include differences in claim numbers and demographic data. LDH also generated reports to identify recipients that CMS added to Part B Buy-In that LDH should also enroll into Part A Buy-In. The LDH Buy-In section reviewed the reports and ensured that necessary corrections and additions were made to recipient records in the Buy-In system which stored Buy-In eligibility data. However, after November 2018, LDH did not continue this process and lacked other procedures to address variances on a consistent and timely basis. In November 2018, LDH implemented a new eligibility system, LaMEDS, and integrated the old Buy-In system into LaMEDS. LDH developed some Buy-In reports in LaMEDS for monitoring of variances, but the reports were not used. The LDH Buy-In section addressed variances when notified on a case-by-case basis, in addition to working with LDH LaMEDS staff to address recurring errors. However, LDH lacked any formal consistent procedures to timely address variances. Effect: LDH did not update recipient records and make monthly Buy-In payments for all recipients who qualified for the benefit. Recommendation: LDH should develop formal procedures to ensure Buy-In variances are addressed on a consistent basis and in a timely manner. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-18).

2019-025 - Inadequate Controls over Monitoring of Abortion Claims Award Years: 2018, 2019 Award Numbers: 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH did not have adequate controls to ensure compliance with federal requirements prohibiting the use of federal funding for abortion claims. Criteria: Federal requirements prohibit Medicaid and LaCHIP funding for abortion services except in instances where abortion is necessary to save the mother?s life or if the pregnancy is the result of an act of rape or incest. Cause: LDH?s fiscal intermediary performed some monitoring of fee-for-services claims for compliance, but LDH did not monitor or review any reporting from the FI to determine if procedures were properly designed and effective. LDH included a provision in the Healthy Louisiana managed care contracts requiring the managed care health plans to comply with the federal regulation, but LDH did not have any procedures in place to monitor the health plan?s compliance with the contract requirement. LDH provided that monitoring was not performed because identifying applicable claims is difficult and would likely require medical record reviews. Effect: Because LDH did not actively monitor compliance with the requirement, the Medicaid and LaCHIP programs may have paid for abortion services that did not meet exceptions noted in federal regulations. Recommendation: LDH should monitor all claims for Medicaid and LaCHIP recipients, including those paid by the managed care health plans, for compliance with federal regulations regarding prohibited abortions. Management?s Response and Corrective Action Plan: Management did not specifically concur or disagree with the finding but provided a corrective action plan (B-19).

2019-026 - Inadequate Controls over Quarterly Federal Expenditure Reporting Award Year: 2019 Award Numbers: 1905LA5021, 1905LA5MAP Compliance Requirement: Reporting Repeat Finding: Yes (Prior Year Finding No. 2018-026) See Schedule of Findings and Questioned Costs for chart/table Condition: For the fifth consecutive year, LDH failed to accurately complete the required quarterly reports of federal expenditures resulting in $17,279,582 ($14,683,758 federal) in expenditures for Substance Use Disorder (SUD) waiver services not identified and reported separately as required by CMS. In fiscal year 2019, LDH paid for services under the SUD waiver while identifying and reporting these expenditures as state plan expenditures. Criteria: The SUD waiver authorizes Louisiana to receive federal financial participation for the continuum of services to treat addiction to opioids or other substances, including services provided to Medicaid enrollees with substance use disorders residing in certain residential treatment facilities that meet the definition of an Institution for Mental Disease. The approved waiver document requires quarterly reporting of expenditures associated with populations affected by the waiver services. The waiver requires such expenditures to be reported on applicable waiver sections of the federal expenditures report as federal reporting is used to monitor budget neutrality requirements for the waiver. While total expenditures for Medicaid and LaCHIP were not misstated due to the classification error, CMS requires accurate reporting of Medicaid and LaCHIP expenditures. Cause: LDH failed to properly identify expenditures for the SUD waiver in the statewide accounting system for appropriate classification on federal reporting. In addition, LDH has implemented some controls over preparation and review of the quarterly expenditure reports, but did not detect the error until after June 30, 2019. Effect: The federal expenditures reported in the quarterly reports are used by CMS to track state Medicaid and LaCHIP expenditures and to ensure proper application of federal participation rates. Errors in federal reporting limit the usefulness of the reports and put the state at risk for improper claiming of federal funds and noncompliance with waiver agreements. LDH made corrections to the September 2019 reports to report the expenditures as SUD waiver. Recommendation: LDH should ensure that expenditures are accurately classified in the statewide accounting system and federal expenditures are reported accurately by appropriate category on the required quarterly federal reports. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-21).

2019-027 - Inadequate Controls over Waiver Services Providers Award Year: 2019 Award Number: 1905LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: Yes (Prior Year Finding No. 2018-025) See Schedule of Findings and Questioned Costs for chart/table Condition: For the eighth consecutive year, LDH paid Medicaid Home- and Community-Based Services (HCBS) claims for the New Opportunities Waiver (NOW), Residential Options Waiver (ROW), and Community Choices Waiver (CCW) totaling $11,949 ($7,767 in federal funds and $4,182 in state funds) for waiver services that were not documented in accordance with established policies. NOW and ROW are administered by the LDH Office for Citizens with Developmental Disabilities (OCDD). CCW is administered by the LDH Office for Aging and Adult Services (OAAS). Waiver services are accessed through support coordinators who assist with development and monitoring of the recipient?s plan of care (POC). Our testing of waiver services included 306 claims paid in fiscal year 2019 totaling $38,629 paid to two providers for 10 recipients. The recipients received services from three waivers: NOW, ROW, and CCW. Our test identified errors for 103 claims, some claims having multiple errors, totaling $11,949, which is considered questioned costs. For the NOW and ROW waivers administered by OCDD, the following were noted: ? For 13 claims for five recipients, waiver services providers did not provide adequate documentation to support billed services. Time sheets, progress notes, and electronic visit verification (EVV) documentation were not consistent. ? For 44 claims for six recipients, the waiver services provider did not provide documentation to support deviations from the approved POC. The POC documents the recipient?s assessed needs and types and quantity of services to address those needs and costs related to services. Direct service providers provide care to a recipient based on the approved POC. Without documentation a provider cannot substantiate and auditors cannot verify that the deviations were recipient-driven and person-centered as required. ? For eight claims for five recipients, auditors were unable to determine if a deviation from the POC occurred because time sheets, progress notes, and EVV documentation were not consistent. For the CCW waiver administered by OAAS, the following were noted: ? For one claim for one recipient, the waiver services provider did not provide adequate documentation to support billed services. Progress notes and EVV documentation were not consistent. ? For 51 claims for two recipients, the waiver services provider did not provide documentation to support deviations from the approved POC. Errors noted deviations of 30 minutes or more. Criteria: Auditors used LDH?s provider manuals to identify required documentation. Provider manuals are intended to give a provider the information needed to fulfill its vendor agreement with the state of Louisiana, and is the basis for federal and state reviews of the program. According to the provider manuals, prior to billing for services, the NOW and ROW service provider must verify that time sheets and progress notes are completed correctly and that the services were delivered in accordance with the POC. According to OCDD, since the implementation of EVV, time sheet documentation is no longer required for Medicaid supporting documentation, but that information is not reflected in updates to the NOW or ROW manuals. According to the ROW provider manual, providers are to record any changes or deviations from the POC. According to the NOW provider manual, an occasional or temporary deviation from a recipient?s scheduled services is acceptable as long as the services altered are recipient-driven, person-centered, and occur within the prior authorization. When a recipient?s schedule is altered on a consistent basis, a revision to the approved POC is required indicating the reason for the change. According to the CCW provider manual, significant deviations must be documented. Significant is not defined. LDH HCBS waivers implemented EVV in fiscal year 2019. EVV is a web-based system that electronically records and documents the precise date, start time, and end times that services are provided to recipients. Time documented through EVV is the time billed to Medicaid for services. Providers are required to maintain certain other supporting documentation to support all time billed. Cause: The errors noted occurred because LDH failed to ensure that NOW, ROW, and CCW providers follow LDH policy, which includes review of documentation to support services billed for accuracy and documenting deviations from the POC. In addition, LDH OCDD did not update provider manuals to reflect potential revised documentation requirements. Effect: Without adequate supporting documentation and compliance with LDH established policies, there is reduced assurance that recipients are receiving needed services, billed services were actually performed, and limited resources are allocated appropriately. Recommendation: LDH should ensure all departmental policies and federal regulations for waiver services are enforced, including documentation to support claims and evidence deviations from the approved POC meet the needs of the recipient. In addition, LDH should ensure all provider manuals are updated timely. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-22).

2019-028 - Inadequate Internal Control over Modified Adjusted Gross Income (MAGI) Eligibility Determinations Award Years: 2018, 2019 Award Numbers: 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2018-027) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LDH failed to design and maintain adequate internal control over MAGI-based eligibility determinations in the Medicaid and LaCHIP programs. Criteria: In 2014, through the Affordable Care Act, federal regulations changed the requirements for Medicaid eligibility determinations to a new methodology using federal income tax information (FTI) known as MAGI. The new MAGI determination process significantly changed the way Medicaid eligibility is determined for a large percentage of the Louisiana Medicaid program. Cause: In a previous Medicaid Audit Unit (MAU) report, Medicaid Eligibility: MAGI Determination Process, issued in December 2018, we noted that LDH did not use federal and/or state tax information to verify certain self-attested eligibility factors, including tax filer status, household size, self-employment income, and other types of income. This other income could include retirement and annuities, interest and dividends, and rentals and royalties. We determined this lack of verification to be a weakness in internal control, because tax information was the only trusted source for these critical Medicaid MAGI eligibility factors. LDH noted that FTI would be incorporated into the eligibility system for use in the verification process in May 2019. In a follow up MAU report titled Status on the Use of Federal Tax Information, issued September 11, 2019, we reported that LDH had not implemented the use of FTI for MAGI-based eligibility determinations. Because LDH has not implemented the use of tax information for MAGI-based determinations, LDH continues to be unable to verify all critical eligibility factors. We determined that the lack of internal control due to not using federal tax information for verifications is applicable to all of the 1.4 million recipients in the MAGI eligibility group with premiums paid on their behalf. Effect: While the new methodology was designed around federal tax data, LDH did not use FTI to verify critical Medicaid eligibility factors, resulting in a lack of internal control and increased risk that applicants could be determined eligible when they are not. In fiscal year 2019, LDH Medicaid and LaCHIP program expenditures totaled $12 billion. As of June 30, 2019, there were approximately 1.6 million recipients in Louisiana Medicaid. Of these recipients, approximately 1.4 million (89%) were determined eligible in a MAGI eligibility group by LDH and had Healthy Louisiana managed care premium payments made to the MCO on their behalf. The MCOs are responsible for payment of provider claims for Medicaid services. LDH paid approximately $7.9 billion in Healthy Louisiana managed care premiums with $5.5 billion dollars in premiums paid on behalf MAGI-based recipients. Since LDH did not use tax information in fiscal year 2019 and auditors are restricted by law from using tax information in the audit of Medicaid and LaCHIP eligibility, we are unable to obtain sufficient appropriate evidence to adequately test MAGI-based Medicaid eligibility. We consider this a scope limitation for our audit. Recommendation: LDH should design and implement adequate internal control to ensure and document accurate MAGI-based eligibility determinations. In addition, LDH should consider using federal tax data to verify critical Medicaid and LaCHIP eligibility factors that cannot be verified by other electronic sources. Management?s Response and Corrective Action Plan: Management concurred in part and provided a corrective action plan. Management asserts that LDH has adequate controls over MAGI-based eligibility determinations due to the new eligibility system, LaMEDS, using multiple electronic data sources for verification (B-24). Auditor?s Additional Comments: For fiscal year 2019, LDH did not use FTI to verify critical eligibility factors that cannot be verified by other electronic sources, which increases risk that applicants could be determined eligible when they are not.

2019-029 - Noncompliance on Managed Care Premium Payments Award Years: 2018, 2019 Award Numbers: 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Activities Allowed or Unallowed Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH made premium payments totaling approximately $4.8 billion to the Healthy Louisiana MCOs without first receiving required contract amendment approvals. Also, LDH made payments totaling approximately $868 million for service dates outside of the certification period provided by the actuary?s Rate Certification Letter. For fiscal year 2019, LDH made Medicaid and LaCHIP payments totaling $7.9 billion to the Healthy Louisiana MCOs. In our review of the Healthy Louisiana premium payments made during the fiscal year, the following were identified: ? LDH made premium payments using rates from the actuary?s Rate Certification Letter contained in Contract Amendment Number 14 starting in July 2018 for May 2018. Contract Amendment Number 14 was not signed by the MCOs until late October 2018, not submitted for approval to the Office of State Procurement (OSP) until late October 2018, and not approved by OSP until December 2018. Payments made on Contract Amendment Number 14 prior to OSP approval totaled more than $3.9 billion. ? LDH made premium payments using rates from the actuary?s Rate Certification Letter contained in Contract Amendment Number 17 starting in June 2019 for April 2019. Contract Amendment Number 17 was not signed by the managed care plans until late June 2019, not submitted to the OSP until July 2019, and not approved by OSP until August 2019. Payments made on Contract Amendment Number 17 as of June 30, 2019, totaled more than $906 million. ? LDH paid the MCOs for February 2019 in March 2019 using the actuary?s Rate Certification Letter from Contract Amendment Number 15. The Rate Certification Letter in Contract Amendment Number 15 was for dates July 2018 through January 2019 and not certified by the actuary for use in February 2019. In June 2019, LDH adjusted rates based on Contract Amendment Number 16 with the accompanying Rate Certification Letter for dates including February 2019. Payments made for February 2019 using the inappropriate rates from Contract Amendment Number 15 totaled more than $629 million. ? LDH paid the MCOs for April 2019 in May 2019 using an actuary?s Rate Certification Letter from Contract Amendment Number 16. The Rate Certification Letter in contract Amendment Number 16 was for dates January 2019 through March 2019 and not certified by the actuary for use in April 2019. In June 2019, LDH adjusted April 2019 rates based on Contract Amendment Number 17 and the accompanying Rate Certification Letter for dates including April 2019. Payments made for April 2019 using the inappropriate rates from Contract Amendment Number 16 totaled more than $239 million. Criteria: Louisiana Administrative Code, Title 34, Part V. Procurement, Section 2512, requires that all amendments to contracts for professional, personal, consulting, and social services contracts be submitted to OSP and shall become effective only upon approval. Healthy Louisiana contract amendments, categorized as a social services contract, document changes to the managed care program, including updates and changes in rate certifications when necessary. Each actuary?s Rate Certification Letter stipulates the population and time period covered by the accompanying rates along with a statement certifying the rates as actuarial sound in accordance with 42 CFR Section 438. Rate certifications should be determined for a 12-month rating period, but CMS considers time periods other than 12 months to address unusual circumstances. For fiscal year 2019, LDH made payments using four contract amendments and six Rate Certification Letters. One rate letter included a 12-month certification period while the other five letters had certification periods varying from three to nine months. Cause: LDH failed to design and maintain adequate controls over the timely submission of contract amendments to OSP to ensure contract amendments were approved prior to any payments under the amendment. LDH also failed to design and maintain adequate controls to ensure Rate Certifications Letters covered the period for which the payment was made. Effect: By paying the MCOs prior to contract amendment approvals, LDH may have made payments without proper authorization that were noncompliant with state procurement regulations. By paying the MCOs with rates outside of the rate certification period, LDH may have violated federal regulations requiring payments using actuarial sound rates. Recommendation: LDH should ensure compliance with state purchasing requirements, including obtaining proper contract amendment approvals prior to implementation. In addition, LDH should only make payments using Rate Certification Letters that have been included in an approved contract amendment and for the period certified in the rate letter. Management?s Response and Corrective Action Plan: In its response, management did not dispute the facts reported regarding dates of the relevant premium payments, rates used to make the payments, or dates of contract amendment approvals. However, management did not agree that the payments made and rates used were inappropriate or noncompliant, so a corrective action plan was not provided (B-26). Auditor?s Additional Comments: LDH acknowledges payments were made using rate certification letters in contract amendments prior to submission to OSP and OSP approval and making payments for service dates using rate certification letters that did not cover the respective service dates. LDH noted that in its opinion these instances should be considered an ?inevitable? part of the process in setting managed care per member per month payments. However, LDH should strive to implement processes and/or controls to ensure that state and federal regulations are met. LDH should not continue processes that make noncompliance ?inevitable.?

2019-030 - Noncompliance with Managed Care Provider Enrollment Requirement Award Years: 2018, 2019 Award Numbers: 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2018-028) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LDH did not enroll and screen Healthy Louisiana managed care providers and dental managed care providers as required by federal regulations. Currently, the managed care plans continue to enroll and screen all providers, in violation of federal regulations. Criteria: 42 CFR 438.602 (2016 Managed Care Final Rule) and Section 5005 of the 21st Century Cures Act require that the enrollment process include providing the Medicaid agency with the provider?s identifying information including the name, specialty, date of birth, Social Security number, national provider identifier, federal taxpayer identification number, and state license or certification number of the provider. Additionally, the state agency is also required to screen enrolled providers, require certain disclosures, provide enhanced oversight of certain providers, and comply with reporting of adverse provider actions and provider terminations. By using the new federally required process, managed care providers must participate in the same screening and enrollment process as Medicaid and LaCHIP fee-for-service providers. Cause: LDH noted that enrollment and screening of managed care providers will not be performed until the new provider management system is implemented. LDH has not implemented the new system as of November 2019. LDH will continue to be in violation until a new provider enrollment system is implemented and all providers are enrolled in the new system. Effect: LDH was required to enroll and screen all Healthy Louisiana managed care providers by January 2018 and dental managed care providers by July 2018. LDH failed to do this and is in violation of federal law. LDH cannot ensure the accuracy of provider information obtained from the Louisiana Medicaid managed care plans and cannot ensure compliance with enrollment requirements defined by law and the Medicaid and LaCHIP state plan. LDH accepted 88.5 million Healthy Louisiana encounter claims totaling $5.3 billion and 4.2 million dental encounter claims totaling $152 million in fiscal year 2019 from the managed care plans and paid $7.9 billion in Healthy Louisiana premiums and $172 million in dental premiums. Recommendation: LDH should ensure all providers are screened, enrolled, and monitored as required by federal regulations. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-28).

2019-031 - Noncompliance with Prenatal Service Third-Party Liability Requirements Award Years: 2018, 2019 Award Numbers: 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH failed to implement controls to ensure compliance with revised third-party liability requirements for prenatal and pregnancy related services. Criteria: 42 CFR 433 requires that the Medicaid and LaCHIP programs are the payers of last resort. In most cases, federal law requires states to apply cost avoidance measures to claims by which all other payers are identified and payments from those identified payers are applied to the claim first. Medicaid and LaCHIP funds would then be used for the remaining balance as applicable. Previously, regulations considered prenatal and pregnancy related services an exception to the cost avoidance requirement and required states to pay prenatal and pregnancy related claims without regard to any other liable third party. States could seek to recover payments from another liable third party at a later date through a process known as ?pay and chase.? The Bipartisan Budget Act of 2018 (Public Law 115-123) revised the Social Security Act, the authorizing legislation for Medicaid and LaCHIP programs, to eliminate the cost avoidance exception for prenatal services and pregnancy related services effective in February 2018. Cause: LDH did not update the managed care contracts to require compliance with the revised regulation, did not provide any guidance to the managed care plans regarding implementation of the revised regulations, and did not monitor plan compliance with the revised regulation. While a much smaller portion of the Louisiana Medicaid program, LDH also did not implement the revised regulation for fee-for-service prenatal claims. According to LDH, the revised federal regulation has not been implemented because CMS has not issued clear guidance for implementation. Effect: The Medicaid and LaCHIP programs may have paid full or partial claims that were the responsibility of other payers. Louisiana Medicaid managed care plans would be responsible for a majority of the services relevant to the revised requirement. LDH has accepted more than 2 million encounters totaling $145.6 million for prenatal services with dates of service from February 2018 through June 2019. LDH did not provide criteria for identifying prenatal encounters that were processed as pay and chase. Managed care encounters are used by LDH?s actuary for future rate setting and as a basis for making supplemental payments, known as kick payments, to the managed care plans for costs associated with pre- and post-partum maternal care, as well as the delivery event itself. LDH paid $512 million in kick payments for dates of service from February 2018 through June 2019. For fee-for-service claims paid in state fiscal year 2019 with dates of service from February 2018 through June 2019, LDH paid $1,692 for prenatal and pregnancy related claims processed as pay and chase. Recommendation: LDH should ensure that cost avoidance measures are applied for prenatal services as required by the Bipartisan Budget Act of 2018 and the Social Security Act and that the Medicaid and LaCHIP programs are the payers of last resort. Management?s Response and Corrective Action Plan: Management concurred in part with the finding and provided a corrective action plan (B-30). Auditor?s Additional Comments: In its response, management acknowledged that the United States Code was amended but noted that the Code of Federal Regulations provision had not been updated, and CMS had not provided guidance until November 2019. However, this does not change LDH?s responsibility to implement controls addressing the revised federal requirement that was effective in February 2018.

2019-032 - Noncompliance with Provider Revalidation and Screening Requirements Award Years: 2018, 2019 Award Numbers: 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Special Tests and Provisions Repeat Finding: Yes (Prior Year Finding No. 2018-029) See Schedule of Findings and Questioned Costs for chart/table Condition: For the second consecutive year, LDH did not perform five-year revalidations; screenings based on categorical risk of fraud, waste or abuse; and monthly checks of the federal excluded party database, as required by federal regulations for all Medicaid and LaCHIP fee-for-service providers. In a non-statistical random sample of 40 providers from 22,191 providers receiving fee-for-service Medicaid and LaCHIP payments from LDH in fiscal year 2019, we noted that for 34 (85%) providers, LDH did not perform the required five-year revalidation, including screening based on categorical risk. The 34 providers have enrollment dates ranging from three to 44 years ago. In addition, LDH did not routinely check one of the required federal databases to determine if providers have been excluded from participation in federal programs. While LDH checked the List of Excluded Individuals/Entities (LEIE) on a monthly basis, it did not perform checks of the System for Award Management (SAM) after the provider was initially enrolled. The SAM database includes information on providers excluded from contracting with the federal government. Criteria: Federal regulations (42 CFR 455, Subpart E) require that LDH screen all providers according to the provider?s categorical risk level upon initial enrollment, re-enrollment, or revalidation of enrollment. LDH must complete a revalidation of enrollment for all providers, regardless of type, at least every five years. The required screening procedures for each provider varies based on the risk score ? limited, moderate, or high. For example, a high risk score requires additional screening procedures including criminal background checks and fingerprinting. These federal regulations also require LDH to check the LEIE and the SAM on at least a monthly basis. LDH submitted and received the Medicaid State Plan approval in 2012 regarding compliance with revalidation and screening requirements. Cause: LDH has noted that performance of all required revalidations, screenings, and monthly checks would be implemented in the new provider management system. LDH has not implemented the new system as of November 2019. Effect: Proper enrollment and revalidation, including screening based on categorical risk and monthly checks of required databases would enable the state to identify ineligible providers that should be rejected or excluded from the program. Not performing the required revalidations and screenings increases the risk that providers will continue to perform services for Medicaid recipients when they should be excluded. Recommendation: LDH should ensure all providers are screened based on categorical risk level upon initial enrollment, re-enrollment, and revalidation of enrollment as required by federal regulations. Also, LDH should perform revalidation of enrollment on all providers at least every five years. In addition, LDH should ensure all required databases are checked at least monthly. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-32).

2019-033 - Noncompliance with Third-Party Liability Assignment Award Years: 2018, 2019 Award Numbers: 1805LA5021, 1805LA5MAP, 1905LA5021, 1905LA5MAP Compliance Requirement: Eligibility Repeat Finding: Yes (Prior Year Finding No. 2018-030) See Schedule of Findings and Questioned Costs for chart/table Condition: For the third consecutive year, LDH failed to maintain evidence of notification of third-party liability (TPL) assignment as required for eligibility in the Medicaid and the LaCHIP programs. In a non-statistical random sample of 60 active recipient case records from 1,835,973 recipients, 18 (30%) recipient case records did not contain evidence of TPL assignment notification. Criteria: Per 42 CFR 433, Medicaid is the payer of last resort. As a condition of eligibility, each applicant/enrollee must assign to the state their individual rights to medical support and other third-party payments, and such rights of any other eligible individuals under their legal authority. By state law, TPL assignment is automatic but notification must be provided to the applicant/enrollee. Cause: LDH provides notification to an applicant/enrollee by including assignment language on Medicaid and LaCHIP applications. LDH utilizes both paper and electronic applications. During state fiscal year 2019, TPL assignment language was not included as part of electronic application summaries in all recipient case records. In response to the prior-year finding, LDH planned corrective action in conjunction with the launch of the new eligibility system, LaMEDS, in November 2018, but LDH?s corrective action was prospective in nature and did not attempt to remedy cases in which recipients with case files lacking TPL assignment notification do not complete a new application in LaMEDS. Effect: Third parties are legally-liable individuals, institutions, corporations (including insurers), and public or private agencies who are or who may be legally responsible for paying medical claims. Without the assignment of TPL rights, the state may be at risk for payments that should be the legal obligation of another party. Recommendation: LDH should ensure notification of TPL assignment is included in each Medicaid and LaCHIP recipient case record as part of required documentation to support the eligibility decision. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-34).

2019-034 - Weaknesses in Controls over LaMEDS Award Year: 2019 Award Numbers: 1905LA5021, 1905LA5MAP Compliance Requirement: Eligibility Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: LDH had weaknesses in controls over its new Medicaid and LaCHIP eligibility and enrollment system, LaMEDS. LaMEDS was implemented in November 2018. All recipient eligibility records are stored in LaMEDS. Criteria: LDH is the single state agency responsible for the administration of the Medicaid and LaCHIP programs. As such, LDH is responsible for adequate internal control over any system used in administration of the program. Internal controls, including proper monitoring of user access and logs, monitoring of interface errors, and proper monitoring of hardware and software availability help to mitigate the risk of improper eligibility determinations. We evaluated system controls based on best practices, as defined by Control Objectives for Information and Related Technology, a framework developed by ISACA. Cause: LDH did not follow established procedures for user access control and lacked monitoring procedures for reviewing user access, override logs, audit logs, and underlying database changes. Our procedures identified the following: ? LDH failed to remove access for separated employees. ? LDH only performed one user access review and failed to makes all changes noted as a result of the review. ? LDH lacked a process of tracking non-LDH contract employee access to LaMEDS. ? LDH did not review logs tracking manual overrides and audit changes for inappropriate overrides and changes. LDH lacked a formal process for monitoring and timely resolving logged interface errors. LaMEDS interfaces with multiple state and federal databases to verify eligibility factors. The agreement between LDH and the Office of Technology Services (OTS) did not provide for availability monitoring of hardware and software managed and supported by OTS. Effect: Instances of inappropriate access may have violated the HIPAA Security Rules because users retained access to protected health information after they no longer had an allowed need for that access. Lack of established procedures can result in inconsistent application and unnoticed interface failures that negatively impact the eligibility determination process. OTS may not be accountable for application downtime resulting from the failure of supporting hardware, software, and infrastructure that it maintains. Recommendation: Management should immediately disable a separating employee?s access and hold supervisors responsible for requesting removal; perform user access reviews at least bi-annually and update all changes as a result of the reviews; establish procedures for monitoring non-LDH contract employees, and establish procedures for reviewing user access, override logs, and audit logs. LDH should establish formal procedures for monitoring interface errors. LDH should update its agreement with OTS to require availability metrics and obtain and monitor achievement of agreed upon availability levels. Management?s Response and Corrective Action Plan: Management concurred in part and provided corrective action plans (B-35). Auditor's Additional Comments: LDH did not concur with the finding regarding user access reviews and the monitoring of audit logs, citing that CMS only requires an annual review of user access and does not require monitoring of all audit logs. During our work, we noted a high frequency of user access changes due to employee and contractor turnover. This frequency places LDH at an increased risk of allowing inappropriate access to users who no longer have a business need. The HIPAA Security Rule [(45 CFR ?164.308(a)(1)(ii)(B))] provides that covered entities must "implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level." A review of access only once a year does not appear to sufficiently reduce this risk. Also, the absence of CMS guidance regarding specific logs to review does not remove LDH's responsibility for identifying the appropriate logs and monitoring them for unauthorized activity. LDH concurred in part with our recommendation regarding interface error monitoring but noted it had a detailed design specification document that established ?a formal process for error standardization? that provides steps for particular errors. However, based on our review, the detailed design specification document does not negate the need for policies and procedures for staff to reference when handling interface errors during normal operations.

2019-035 - Noncompliance and Control Weakness Relating to Foster Care Billings Award Years: 2018, 2019 Award Numbers: 1801LAFOST, 1901LAFOST Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Department of Public Safety and Corrections ? Youth Services ? Office of Juvenile Justice (OJJ) did not adequately review Foster Care invoices submitted to DCFS for reimbursement to ensure billings were made in accordance with approved contract rates and only included allowable dates of service. A non-statistical sample of three maintenance (cost of care) invoices billed to DCFS totaling $792,182 from a population of 11 maintenance invoices totaling $3,026,043, disclosed exceptions for all three (100%) invoices, some of which had more than one error, as follows: ? For one invoice, OJJ billed for 11 days that had been previously reimbursed, resulting in an overpayment of $1,016. ? For one invoice, the daily rate billed for two residential facilities did not agree to the contract rate, resulting in overpayments of $809. ? For one invoice, OJJ paid the residential facility for 28 days but requested reimbursement for 29 days, resulting in an overpayment of $92. ? For one invoice, OJJ paid the residential facility for 27 days but requested reimbursement for 28 days, resulting in an overpayment of $92. ? For three invoices, OJJ paid residential facilities the enhanced supervision rate for certain residents but requested reimbursement at the basic supervision rate, resulting in an underpayment of $6,661. Due to the exceptions noted above, additional procedures were performed on the remaining eight maintenance invoices paid in fiscal year 2019, some of which had more than one error. Audit procedures disclosed the following: ? For two invoices, the daily rate billed for two residential facilities did not agree to the contract rate, resulting in overpayments of $4,100. ? For seven invoices, OJJ paid residential facilities the enhanced supervision rate for certain residents but requested reimbursement at the basic supervision rate, resulting in an underpayment of $14,839. Criteria: Per OJJ?s contract with DCFS for reimbursement of Foster Care expenditures, OJJ must submit monthly maintenance billing reports to DCFS including only days for which the child is eligible. In addition, the reimbursement rate is the lower of OJJ?s negotiated daily contract rates with its residential facilities and DCFS?s established rate for the level of services. 2 CFR 200.303 requires that non-federal entities receiving federal awards establish and maintain effective internal controls designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Cause: These conditions occurred because of a weakness in controls in the review of Foster Care maintenance invoices. Effect: Failure to properly review invoices resulted in over and under billings and could result in disallowed costs by the federal grantor. In total, there were $6,109 in overpayments considered questioned costs and $21,500 in underpayments. Recommendation: OJJ should adequately review invoices submitted to DCFS and ensure it only bills for allowable days, as well as at the established daily and supervision rates. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-38).

2019-036 - Weakness in Controls with Special Tests and Provisions Requirements Award Years: 2018, 2019 Award Number: FAIN P20GM121307 Compliance Requirement: Special Tests and Provisions Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: Louisiana State University Health Sciences Center in Shreveport (Center) did not have adequate controls in place to ensure compliance with Special Tests and Provisions requirements. In a non-statistical sample of 17 federal R&D Cluster awards for the fiscal year ending June 30, 2019, from a population of 16,782 expense transactions, one (6%) of the awards had documentation of the key personnel?s effort that did not agree to the effort reported to the federal grantor, and there was no evidence of prior approval from the federal grantor for change in key personnel. Criteria: 2 CFR 200.308 states that for non-construction federal awards, recipients must request prior approvals from federal awarding agencies for one or more of the following program or budget-related reasons: (i.) Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). (ii.) Change in a key person specified in the application or the federal award. (iii.) The disengagement from the project for more than three months, or a 25 percent reduction in time devoted to the project, by the approved project director or principal investigator. Cause: The Center has procedures in place for personnel to certify actual time and effort expended on federal awards, but does not have adequate monitoring procedures to ensure the certifications are accurate and prior written approval is obtained from the federal grantor for changes in effort for key personnel. Effect: Failure to fully implement controls over key personnel requirements could result in noncompliance with Special Tests and Provisions requirements. Recommendation: Management should utilize the time and effort certifications to monitor changes in effort for key personnel and obtain written approval from the federal grantor for changes that exceed the thresholds in 2 CFR 200.308. Management?s Response and Corrective Action Plan: Management partially concurred with the finding and provided a corrective action plan (B-41).

2019-037 - Weaknesses in Controls over Federal Research and Development Expenses Award Years: 2017, 2018 Award Numbers: FAIN R01NS096225, FAIN U54GM104940, FAIN UG1CA189854 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding: No See Schedule of Findings and Questioned Costs for chart/table Condition: The Center did not adhere to internal policies and procedures to ensure compliance with federal documentation requirements for compensation of personnel services. In a non-statistical sample of 25 out of 16,782 expense transactions charged to the R&D Cluster, we noted the following: ? One (4%) of the time detail reports were not approved by the supervisor. ? Two (8%) had time and effort allocated to the award that did not agree to the time and effort certification of actual time devoted to the award. Criteria: 2 CFR 200.430(i) requires that charges to federal awards for salaries and wages must be supported by a system of internal control which provides a reasonable assurance that the charges are accurate, allowable, and properly allocated. Per 2 CFR 200.430(viii), budget estimates alone do not qualify as support for charges to federal awards, but may be used for interim accounting purposes, provided that significant changes in work activity are identified and entered into the records in a timely manner and the non-federal entity?s system of internal controls includes processes to review after-the-fact charges and make necessary adjustments. Per the Center?s Time and Labor Manual, supervisors are to sign the Time Detail Report before the release of paychecks to employees. In addition, the Center has a time and effort certification policy which requires payroll redistributions to be processed if actual effort percentages vary from the percentage paid by a project as averaged over a three month period. A certification clause must be signed by the employee or a supervisor who has first-hand knowledge of the employee?s effort on the listed account. Cause: The Center has not established adequate monitoring over departments to ensure the compliance with federal regulations and internal policies. Effect: Time and attendance records that are not properly certified, approved, and monitored, as required by federal regulations, increase the risk of payroll error or fraud and may result in disallowed costs. Recommendation: Management should monitor time and attendance records and time and effort certifications completed by the departments to enforce the internal policies established and to ensure compliance with federal documentation requirements. Management?s Response and Corrective Action Plan: Management concurred with the finding and provided a corrective action plan (B-43).

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION