Mesa County, Colorado

Criteria: Per 2 CFR 200.332, Mesa County is responsible for informing subrecipients of the Federal award identifiers including but not limited to award date, period of performance and Federal awarding agency and Assistance Listing Number and title. Mesa County is required to assess the subrecipient’s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. In addition, the County should also verify that the subrecipient is audited as required by Subpart F - Audit Requirement under the Uniform Guidance. The monitoring policy should include an initial valuation of risk of noncompliance to determine the appropriate level of monitoring required related to the subaward as well as appropriate awarding documentation. Condition: During our testing, we evaluated the procedures for evaluating subrecipient’s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. We noted the following: • For two (2) of two (2) subrecipients selected, the required evaluation of the subrecipient’s risk of noncompliance was not documented. Cause: The County did not adhere to their established policies and procedures relating to risk assessment when a subrecipient contract is awarded. Effect: The County’s policies were not consistently followed requiring compliance with the Subrecipient monitoring requirements in 2 CFR 200.332. Additionally, the County’s control policies were not consistently followed. Questioned Costs: None to report. Context/Sampling: The population of two (2) subrecipients were selected for subrecipient monitoring testing for the direct award from the US Department of Treasury. The total population across the program, including sub-awards from the State of Colorado was 2 subrecipients. Repeat Finding from Prior Years: Yes. Recommendation: We recommend that the County adhere to their policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. Views of Responsible Officials: Agree

Criteria: The Federal requirement related to processing of an application requires the State to provide notice of its decision concerning eligibility and provide timely and adequate notice of the basis for denial or termination of assistance (42 USC 1320c-7(d)). According to the Colorado Department of Health Care Policy and Financing (HCPF), processing standards 8.100.3.D, the County is required to process an initial application for any program not requiring a disability determination no later than 45 days following receipt of application. In addition, federal requirements as described at 42 CFR 435.139 and 435.350 requires state medical assistance programs to provide medical coverage for care and services that are necessary to treat a medical emergency for individuals who do not meet immigration or citizenship requirements for Medicaid through Health First Colorado (Colorado’s Medicaid Program). Per the Colorado Department of Health Care policy memo number HCPF PM 22-006, Emergency Medicaid only covers the treatment of emergency medical conditions that a physician determines (confirms) to be life- or limb-threatening and is coded as an emergency. Members who submit an initial application and are determined eligible for Emergency Medicaid Services will receive these services for up to a 12-month period or until the case is redetermined at the end of their renewal period. A 12-month period does not guarantee paid services: all services must be considered emergency treatment by a physician to be covered. Condition: We tested eligibility determination and controls over this process for sixty case files. We noted the following in our testing: • Six instances of non-compliance in which the County did not complete the eligibility determination and approve/deny the case within 45 days and no notice of action was sent to the client within the required timeframe. • One instance of non-compliance in which the County did not identify that the participant no longer qualified for Emergency Medicaid Services and continued to provide benefits to the participant. Cause: Due to the County’s ineffective monitoring, eligibility determinations were not completed in a timely manner and within the 45-day deadline. Effect: Failure to process applications timely could result in participants that are delayed approval of Medicaid services. Questioned Costs: None to report. Context/Sampling: A nonstatistical sample of 60 participants were selected for eligibility testing. Repeat Finding from Prior Years: Yes, 2023-008 Recommendation: We recommend the County utilize available COGNOS reports to determine which cases are nearing the exceeding processing guidelines and which cases are life- or limb-threatening related and ensure re-determinations are completed accurately. Views of Responsible Officials: Agree

Criteria: As a condition of receiving Federal awards, non-Federal entities agree to comply with laws, regulations, and the provisions of grant agreements and contracts, and to maintain internal control to provide reasonable assurance of compliance with these requirements. 2 CFR section Appendix II to Part 200, Contract Provisions for Non-Federal Entity Contracts Under Federal Awards states that in addition to other provisions required by the Federal agency or non-Federal entity, all contracts made by the non-Federal entity under the Federal award must contain certain provisions, as applicable. Condition: The following information was not provided at the time of the contract award for one (1) contract selected for testing: •Byrd Anti-Lobbying Amendment •Clean Air Act and Federal Water Pollution Control Act •Davis-Bacon Act Cause: The County’s procedures did not consistently ensure that the applicable required provisions were communicated to contractors. Effect: The County did not identify the applicable required provisions of the contract to the contractors at the time of the contract award resulting in a finding. Questioned Costs: None to report Context/Sampling: One (1) contract selected for procurement and suspension and debarment testing for the direct award from the US Department of Treasury. The total population across the program, including sub-awards from the State of Colorado was 4 procurement contracts. Repeat Finding from Prior Year(s): No Recommendation: We recommend the County modify and strengthen its current policies and procedures to ensure that all applicable required provisions are communicated to contractors in accordance with 2 CFR Appendix II to Part 200. Views of Responsible Officials: Agree

Criteria: The Uniform Guidance, Section 200.303 Internal Controls, requires that the non-Federal entity must establish and maintain documentation of effective internal controls over Federal awards that provide reasonable assurance that awards are being managed in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Condition: During testing there were four reports that we were unable to test the reporting requirements as the County did not retain evidence of the report. Cause: The County failed to ensure the internal controls surrounding compliance over the program’s reporting criteria was met. Effect: The compliance requirement for reporting for the quarterly reports related to the sub-award received from the Colorado Department of Labor was unable to be tested. Questioned Costs: None to report. Context/Sampling: We selected 13 reports out of 23 required to be submitted with the various awards under this ALN. We were unable to test four reports. Repeat Finding from Prior Years: No. Recommendation: We recommend the County ensure review and approval controls are in place to ensure all required reports are submitted timely. Views of Responsible Officials: Agree

Criteria: Per 2 CFR 200.332, Mesa County is responsible for informing subrecipients of the Federal award identifiers including but not limited to award date, period of performance and Federal awarding agency and Assistance Listing Number and title. Mesa County is required to assess the subrecipient’s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. In addition, the County should also verify that the subrecipient is audited as required by Subpart F - Audit Requirement under the Uniform Guidance. The monitoring policy should include an initial valuation of risk of noncompliance to determine the appropriate level of monitoring required related to the subaward as well as appropriate awarding documentation. Condition: During our testing, we evaluated the procedures for evaluating subrecipient’s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. We noted the following: • For two (2) of two (2) subrecipients selected, the required evaluation of the subrecipient’s risk of noncompliance was not documented. Cause: The County did not adhere to their established policies and procedures relating to risk assessment when a subrecipient contract is awarded. Effect: The County’s policies were not consistently followed requiring compliance with the Subrecipient monitoring requirements in 2 CFR 200.332. Additionally, the County’s control policies were not consistently followed. Questioned Costs: None to report. Context/Sampling: The population of two (2) subrecipients were selected for subrecipient monitoring testing for the direct award from the US Department of Treasury. The total population across the program, including sub-awards from the State of Colorado was 2 subrecipients. Repeat Finding from Prior Years: Yes. Recommendation: We recommend that the County adhere to their policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. Views of Responsible Officials: Agree

Criteria: The Uniform Guidance, Section 200.303 Internal Controls, requires that non-Federal entities must establish and maintain documentation of effective internal controls over Federal awards that provide reasonable assurance that awards are being managed in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Condition: We tested 19 eligibility files for IV-E eligibility determinations and noted there was no evidence of internal controls over the determination of IV-E eligibility for all of the files tested. Cause: The County did not have the appropriate controls in place to comply with the Uniform Guidance Section 200.303 over Internal Controls over compliance with Federal awards. Effect: The County is not in compliance with the Uniform Guidance requirements of internal controls. Questioned Costs: None to report. Context/Sampling: A nonstatistical sample of 19 IV-E children files out of 91 were selected for eligibility testing. Repeat Finding from Prior Years: No. Recommendation: We recommend the County implement controls which include a review of all eligibility files for IV-E determinations. Views of Responsible Officials: Agree

Criteria: The Uniform Guidance, Section 200.303 Internal Controls, requires that non-Federal entities must establish and maintain documentation of effective internal controls over Federal awards that provide reasonable assurance that awards are being managed in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Condition: We tested 6 eligibility files for eligibility determinations and noted there was no evidence of internal controls over the determination of eligibility families for all of the files tested. Cause: The County did not have the appropriate controls in place to comply with the Uniform Guidance Section 200.303 over Internal Controls over compliance with Federal awards. Effect: The County is not in compliance with the Uniform Guidance requirements of internal controls. Questioned Costs: None to report. Context/Sampling: A nonstatistical sample of 6 files out of 27 were selected for eligibility testing. Repeat Finding from Prior Years: No. Recommendation: We recommend the County implement controls which include a review of all eligibility files for family determinations. Views of Responsible Officials: Agree

Criteria: The Federal requirement related to processing of an application requires the State to provide notice of its decision concerning eligibility and provide timely and adequate notice of the basis for denial or termination of assistance (42 USC 1320c-7(d)). According to the Colorado Department of Health Care Policy and Financing (HCPF), processing standards 8.100.3.D, the County is required to process an initial application for any program not requiring a disability determination no later than 45 days following receipt of application. Condition: We tested eligibility determination and controls over this process for sixty case files. We noted the following in our testing: •Nine instances of non-compliance in which the County did not complete the eligibilitydetermination and approve/deny the case within 45 days and no notice of action wassent to the client within the required timeframe. Cause: Due to the County’s ineffective monitoring, eligibility determinations were not completed in a timely manner and within the 45-day deadline. Effect: Failure to process applications timely could result in participants that are delayed approval of Medicaid services. Questioned Costs: None to report. Context/Sampling: A nonstatistical sample of 60 participants were selected for eligibility testing. Repeat Finding from Prior Years: No. Recommendation: We recommend the County utilize available COGNOS reports to determine which cases are nearing the exceeding processing guidelines. Views of Responsible Officials: Agree

Material Weakness, Compliance and Internal Control over Compliance, Subrecipient Monitoring ALN 21.027: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Criteria Or Specific Requirement: Per 2 CFR 200.332, Mesa County is responsible for informing subrecipients of the Federal award identifiers including but not limited to award date, period of performance and Federal awarding agency and Assistance Listing Number and title. Mesa County is required to assess the subrecipient?s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. In addition, the County should also verify that the subrecipient is audited as required by Subpart F- Audit Requirement under the Uniform Guidance. The monitoring policy should include an initial valuation of risk of noncompliance to determine the appropriate level of monitoring required related to the subaward as well as appropriate awarding documentation. Condition: We noted that management did not evaluate the risk of noncompliance of the subrecipient and did not convey expectation of requirements for audit under Federal Regulations. Effect: The County was not in compliance with the subrecipient monitoring regulations set forth in the Uniform Guidance. The possibility exists that noncompliance with federal requirements could go undetected without proper controls over compliance relating to the aforementioned requirements. Questioned Costs: None Context: During the testing performed, we noted the County did not perform a risk assessment of subrecipient nor did the County have documentation of informing the subrecipient of all required rules and regulations, including the need for the subrecipient to receive an audit as required under Uniform Guidance. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that management implement a formal subrecipient monitoring policy that defines how the County will monitor each subrecipient. This policy should include an evaluation of the risk of noncompliance for each subrecipient as well as how the subrecipients will be monitored. The County should also request a copy of the subrecipient?s audit, if applicable.

Eligibility Material Weakness, Internal Control Over Compliance, Eligibility and Special Tests ALN 93.778: Medicaid Cluster Federal Agency: U.S. Department of the Health and Human Services Criteria Or Specific Requirement: The Medicaid program provides medical assistance to individuals whose incomes and resources are insufficient to meet the costs of necessary medical services. Beneficiary eligibility is generally based on financial and non-financial criteria. Mesa is responsible for determining eligibility and establishing controls over the determination of eligible individuals. Condition: Review of eligibility determinations was not documented for all periods during 2022. Cause: Internal controls over the eligibility determinations are the responsibility of management. Mesa County did not follow its formal process in place for reviews of eligibility determinations. Effect: Without sufficient documentation and monitoring controls, Mesa may not timely detect an error in eligibility determinations. Identification As A Repeat Finding: Not Applicable Recommendation: We recommend that Mesa follow the current documented internal control process over review of eligibility determinations. Views Of Responsible Officials And Planned Corrective Action: Mesa agrees with the finding and has put together a correction action plan for the finding. See corrective action plan included in this report.

Finding No: 2019-003 Federal Award Information: U.S. Department of Homeland Security Pass-Through Entity: Colorado Department Of Public Safety CFDA No: 97.039 Federal Award/Pass-through ID: 86704 Compliance Requirement: Reporting Criteria Or Specific Requirement: 2 CFR Section 200.302 requires accurate, current and complete disclosure of the financial results of programs in accordance with reporting requirements. Per the Compliance Supplement, each recipient must report program outlays and program income on a cash or accrual basis, as prescribed by the federal awarding agency. Condition: The County has not established documented controls to provide reasonable assurance of the accuracy of the required submitted reports or compliance with the reporting requirements. While there was a documented review of the federal reporting forms, the financial results did not accurately include the current grant activity. It was noted that the quarterly SF-425 reports were not reconciled with the general ledger expenditures. Cause: The County?s controls over reporting requirements were implemented; however, these controls were designed sufficiently to ensure the accuracy, timeliness and completeness of the financial results of programs in accordance with reporting requirements. Effect: Quarterly form SF-425 could be filed inaccurately. Questioned Costs: Not applicable Context: We tested two of the four quarterly reports, noting that the reports required form SF-425 for these grants had been submitted with incorrect progress amounts. Although each of the four quarterly reports did not agree with general ledger amounts, we note that the total annual difference amounted to $800. Identification As A Repeat Finding: 2018-004 Recommendation: We recommend the County establish and follow a documented internal control process of the grant programs review of the financial reports for completeness and accuracy. Views Of Responsible Officials And Planned Corrective Action: The County agrees with the finding and has put together a corrective action plan for the finding. See corrective action plan included in this report.

Finding No: 2019-004 Federal Award Information: U.S. Department Of Health And Human Services Pass-Through Entity: Colorado Department Of Human Services CFDA No: 93.659 Federal Award/Pass-through ID: Not provided Compliance Requirement: Eligibility Criteria Or Specific Requirement: In accordance with State Plan, Section 7.306.41 E-12, the County is required to review the adoption agreement every three years from the date of the initial agreement. Condition: During testing, we noted one instance where the required three-year review was not performed. Cause: The County?s control over reexamining adoption agreements was not maintained throughout the year. Additionally, within the TRAILS system there is no renewal date control in place. Effect: While any change to the adoption assistance agreement must be reviewed by all parties, by not completing the three-year review, modifications may be required and not identified resulting in over or underpayments to providers. Questioned Costs: Not applicable Context: During testing of adoption assistance clients, we tested 40 case files of clients receiving adoption assistance subsidy payments issued during the year totaling approximately $11.1 million paid on behalf of just over 900 individuals. A non-statistical sampling methodology was used to select the sample. Identification As A Repeat Finding: N/A Recommendation: We recommend the County establish and follow a documented internal control process over the renewal process and create a tracking report from either TRAILS or their internal system to ensure compliance with the three-year renewal and review. Views Of Responsible Officials And Planned Corrective Action: The County agrees with the finding and has put together a corrective action plan for the finding. See corrective action plan included in this report.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION