Pueblo County, ColoradoLocal Government

Criteria or specific requirement: The State prepares the Everyday Eats and Emergency Food Assistance Program Policy and Procedure Manuals, with specific requirements for eligibility, review of case files and documentation retention requirements. The County should have internal controls designed to ensure compliance with these provisions. Condition: During our testing, we noted four out of forty cases that did not have appropriate supporting documentation for program eligibility. Additionally, no formal review process has been established for eligibility files in either program; however, case reviews are taking place on an informal basis. The corrective action on the error within this case file was not taken until brought up during the audit. There were no incorrect payments made. Questioned costs: None Context: Within our sample of forty case reviews, documentation was either missing or insufficient to support the eligibility determination in four instances. While the case reviews were conducted, there is currently no established policy specifying the frequency of reviews or identifying the personnel responsible for conducting them. Cause: The County lacks a formal eligibility review policy, and due to a new system and record retention changes, some eligibility documentation was not kept. Effect: The case file did not have the correct documentation on file. Repeat Finding: No Recommendation: We recommend the County review controls and procedures surrounding the programs including review and record retention requirements. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. This procurement process must be documented with proper supporting documentation. Condition: The County did not have proper procurement documentation available for the contracts tested in the audit. Questioned costs: None Context: Five of the five contracts tested did not have the proper supporting documentation to demonstrate that procurement procedures were followed in accordance with the County’s procurement policy. Cause: The contracts were in process before the funding was assigned to the projects and there was turnover at the County. Effect: Failure to document the procurement process exposes the County to the risk that the County’s procurement policy was not followed before the contracts were awarded. Repeat Finding: Yes, repeat of prior year finding 2023-003. Recommendation: CLA recommends the County follow their internal procurement policy procedures and keep documentation of such procedures to ensure compliance with the federal procurement requirements. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, federal award identification, subrecipient name, subrecipient’s DUNS number, federal award identification number (FAIN), federal award date, subaward start and end date, amount of federal funds obligated, total amount of federal award, federal award project description, name of federal awarding agency, Assistance Listing (ALN) number and name, identification of whether the award is R&D and indirect cost rate for federal award. Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal control should include procedures to ensure required information is communicated prior to the issuance of the subaward. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Per 2 CFR 200.332(d) through (f), pass-through entities must monitor the activities of the subrecipient, which includes reviewing financial reports required by the pass-through entity. Condition: During our testing, we noted subrecipients tested had required information omitted from the sub agreements to the subrecipients including Assistance Listing (CFDA) title and number, subrecipient’s DUNS number, Federal Award Identification Number (FAIN), identification of whether the award is research and development, and indirect cost rate for federal award. Subrecipients tested did not have evidence of the County’s evaluation of the risk of noncompliance by the subrecipients, nor was there evidence of monitoring of annual audits for the subrecipients. Internal checklists that aid in compliance were missing for certain subrecipients. Reporting requirements from the subrecipients to the County were also not met. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Questioned costs: None. Context: Five out of the five subrecipients did not include required information in subaward agreements issued to subrecipients and lacked evidence of both the evaluation of risk of noncompliance of the subrecipient and monitoring of annual audits for the subrecipients. Five of the five subrecipients were missing an internal checklist that is signed by the County Manager. Cause: Lack of sufficient controls in place to ensure that subrecipient agreements contain all required information and are monitored appropriately. Effect: Failure to communicate required information and to adequately monitor the subrecipients could result in subrecipients not properly administering the federal programs in accordance with federal regulations. Repeat Finding: Yes, repeat of prior year finding 2023-004. Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures in place to ensure the required certifications for covered contracts and subawards are received, documented, and contracts are not made with a debarred or suspended party. Condition: During our testing of five covered transactions, we noted the County did not have proper suspension and debarment documentation for the vendors and subawards selected for testing. Questioned costs: None. Context: All five covered transaction tested did not have proper supporting documentation for suspension and debarment procedures. Cause: Lack of sufficient controls in place to ensure that suspension and debarment checks were performed prior to entering into contracts. Effect: Failure to obtain the required certifications or perform verification procedures with the SAM could result in the payment of federal funds to vendors that are suspended or debarred from participation in federal assistance programs. Repeat Finding: Yes, repeat of prior year finding 2023-005. Recommendation: CLA recommends the County obtain certifications from vendors stating their organization is not suspended, debarred, or otherwise excluded from participation in federal assistance programs or document the procedures performed to verify the vendor is not identified as suspended or debarred on SAM. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per the State of Colorado, Colorado Benefits Management System, SOC 1 Type 2 Report, covering July 1, 2023 through June 30, 2024, Complementary User Entity Controls, each county using CBMS is responsible for managing the access privileges granted to each county user. These user organizations should implement controls for authorizing user access for their application users. Condition: The County was not able to produce a listing of all application users for the full year and support that the access controls were operating as designed for the full year. Questioned costs: None Context: The County was able to produce a listing that was for 1/1/2024 -9/3/2024; however was not able to produce a listing of all users for the full 2024 year. Tested 14 selections related to granting and terminating access for the time period covered by the listing, noting no exceptions. Cause: County could not provide documentation that the controls related to access of CBMS were working as designed for the full year. Effect: User access controls could not be tested through the full year. Repeat Finding: No Recommendation: CLA recommends the County runs annual full user reports to ensure that access is being granted and terminated in a timely basis. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: The State prepares the Colorado Child Care Assistance Program (CCAP) Quality Assurance Reviewer Guide, with specific requirements for review of case files. The County should have internal controls designed to ensure compliance with these provisions. Condition: During our testing, we noted one out of ten cases that did not have an appropriate review. The corrective action on the error within this case file was not taken until brought up during the audit. There were no incorrect payments made. Questioned costs: None Context: From our sample of ten case reviews, there was one case where the review was not performed appropriately and the corrective action on the error within the case file (surrounding identification) was not taken at that time. Corrective action was not taken until 9/5/2024 when we inquired of the resolution to the error noted during the review. There were no incorrect payments made related to this error. This error was corrected on 9/5/2024. Cause: The individual responsible for the case did not resolve the error when brought to their attention after the case review in November 2023. Effect: The case file did not have the correct identification verification on file. Repeat Finding: No Recommendation: We recommend the County review controls and procedures surrounding the follow-up by individual case managers surrounding errors noted on their case review to ensure corrective action is taken in a timely manner. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per Colorado Regulation 3.755.17 - Archiving Case Files, the County is responsible for archiving 3 program years plus the current program year files. Condition: During our testing, we noted one out of forty case files the County was unable to locate. Questioned costs: None Context: The County was unable to locate the case file for one of the selected individuals for eligibility testing. Cause: The County is in the process of scanning in old case files as was unable to locate the selected case file. Effect: The County was unable to locate the case file. Repeat Finding: No Recommendation: CLA recommends the County review controls and procedures surrounding file storage/retention to ensure files are being archived in accordance with Colorado Regulation 3.755.17 - Archiving Case Files. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. This procurement process must be documented with proper supporting documentation. Condition: The County did not have proper procurement documentation available for the contracts tested in the audit. Questioned costs: None Context: Seven of the seven contracts tested did not have the proper supporting documentation to demonstrate that procurement procedures were followed in accordance with the County’s procurement policy. Cause: The contracts were in process before the funding was assigned to the projects and there was turnover at the County. Effect: Failure to document the procurement process exposes the County to the risk that the County’s procurement policy was not followed before the contracts were awarded. Repeat Finding: Yes, repeat of prior year finding 2022-003. Recommendation: CLA recommends the County follow their internal procurement policy procedures and keep documentation of such procedures to ensure compliance with the federal procurement requirements. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, federal award identification, subrecipient name, subrecipient’s DUNS number, federal award identification number (FAIN), federal award date, subaward start and end date, amount of federal funds obligated, total amount of federal award, federal award project description, name of federal awarding agency, Assistance Listing (CFDA) number and name, identification of whether the award is R&D and indirect cost rate for federal award. Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal control should include procedures to ensure required information is communicated prior to the issuance of the subaward. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Per 2 CFR 200.332(d) through (f), pass-through entities must monitor the activities of the subrecipient, which includes reviewing financial reports required by the pass-through entity. Condition: During our testing, we noted subrecipients tested had required information omitted from the sub agreements to the subrecipients including Assistance Listing (CFDA) title and number, subrecipient’s DUNS number, Federal Award Identification Number (FAIN), identification of whether the award is research and development, and indirect cost rate for federal award. Subrecipients tested did not have evidence of the County’s evaluation of the risk of noncompliance by the subrecipients, nor was there evidence of monitoring of annual audits for the subrecipients. Internal checklists that aid in compliance were missing for certain subrecipients. Quarterly reports were also not submitted to the County by the subrecipients subsequent to funding. Questioned costs: None. Context: Five out of the five subrecipients did not include required information in subaward agreements issued to subrecipients and lacked evidence of both the evaluation of risk of noncompliance of the subrecipient and monitoring of annual audits for the subrecipients. One of the five subrecipients was missing an internal checklist that is signed by the County Manager. Five of the five subrecipients were provided the funding at the beginning of the grant award period and no required quarterly reports were submitted to the County subsequent to funding. Cause: Lack of sufficient controls in place to ensure that subrecipient agreements contain all required information and are monitored appropriately. Effect: Failure to communicate required information and to adequately monitor the subrecipients could result in subrecipients not properly administering the federal programs in accordance with federal regulations. Repeat Finding: Yes, repeat of prior year finding 2022-004. Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures in place to ensure the required certifications for covered contracts and subawards are received, documented, and contracts are not made with a debarred or suspended party. Condition: During our testing of six covered transactions, we noted all vendors and subawards did not have proper supporting documentation for suspension and debarment procedures for vendors. Questioned costs: None. Context: All six covered transaction tested did not have proper supporting documentation for suspension and debarment procedures. Cause: Lack of sufficient controls in place to ensure that suspension and debarment checks were performed prior to entering into contracts. Effect: Failure to obtain the required certifications or perform verification procedures with the SAM could result in the payment of federal funds to vendors that are suspended or debarred from participation in federal assistance programs. Repeat Finding: Yes, repeat of prior year finding 2022-005. Recommendation: CLA recommends the County obtain certifications from vendors stating their organization is not suspended, debarred, or otherwise excluded from participation in federal assistance programs or document the procedures performed to verify the vendor is not identified as suspended or debarred on SAM. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: 2 CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Award requires compliance with allowable costs and activities. The County should have internal controls designed to ensure compliance with these provisions, including review of expenditure detail when preparing the Scheduled of Expenditures of Federal Awards (SEFA). Condition: The County did not identify SLFRF expenditures associated with revenue replacement funds until after the SEFA was prepared. Questioned costs: None Context: The County had support behind the overall totals reported in aggregate on the SEFA for the SLFRF program, but the specific expenditure detail was not readily available. The County had to go back through and put together expenditure level detail to support the amounts reported on the SEFA. The County worked with an ARPA consultant for the $10 million revenue replacement, but did not have a listing of related expenditures until we brought this up during the audit. Cause: The County did not have proper procedures in place to support amounts reported on the SEFA for the SLFRF program. Effect: The County did not identify SLFRF expenditures associated with revenue replacement funds until after the SEFA was prepared. Repeat Finding: No Recommendation: We recommend the County review its controls and procedures in place surrounding tracking detail of federal expenditures. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: 2 CFR 200.302(b)(3) indicates that records that adequately identify the source and application of funds for federally funded activities are necessary. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income, and interest and be supported by source documentation. Condition: Expenditures originally reported on Schedule of Expenditures of Federal Awards for the year ended December 31, 2021 were understated. In the fiscal year ended December 31, 2022, $1,389,172 of prior year expenditures associated with the Medicaid Cluster were included in the schedule of expenditures of federal awards. Questioned costs: None Context: Expenditures reported on the Schedule of Expenditures of Federal Awards for Assistance Listing Number 93.778 were understated by $ 1,389,172. Cause: Pueblo County?s SEFA reconciliation process inadvertently missed the complete population of expenditures. Effect: Expenditures reported on Schedule of Expenditures of Federal Awards were understated for the year ended December 31, 2021. Repeat Finding: No. Recommendation: CLA recommends the County implement tracking procedures to ensure all federal expenditures are reported on the Schedule of Expenditures of Federal Awards. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. This procurement process must be documented with proper supporting documentation. Condition: The County did not have proper procurement documentation available for the contracts tested in the audit. Questioned costs: None Context: Five of the five contracts tested did not have the proper supporting documentation to demonstrate that procurement procedures were followed in accordance with the County?s procurement policy. Cause: The contracts were in process before the funding was assigned to the projects and there was turnover at the County. Effect: Failure to document the procurement process exposes the County to the risk that the County?s procurement policy was not followed before the contracts were awarded. Repeat Finding: No. Recommendation: CLA recommends the County follow their internal procurement policy procedures and keep documentation of such procedures to ensure compliance with the federal procurement requirements. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, federal award identification, subrecipient name, subrecipient?s DUNS number, federal award identification number (FAIN), federal award date, subaward start and end date, amount of federal funds obligated, total amount of federal award, federal award project description, name of federal awarding agency, Assistance Listing (CFDA) number and name, identification of whether the award is R&D and indirect cost rate for federal award. Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal control should include procedures to ensure required information is communicated prior to the issuance of the subaward. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient?s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Per 2 CFR 200.332(d) through (f), pass-through entities must monitor the activities of the subrecipient, which includes reviewing financial reports required by the pass-through entity. Condition: During our testing, we noted subrecipients tested had required information omitted from the sub agreements to the subrecipients including Assistance Listing (CFDA) title and number, subrecipient?s DUNS number, Federal Award Identification Number (FAIN), identification of whether the award is research and development, and indirect cost rate for federal award. Subrecipients tested did not have evidence of the County?s evaluation of the risk of noncompliance by the subrecipients, nor was there evidence of monitoring of annual audits for the subrecipients. Internal checklists that aid in compliance were missing for certain subrecipients. A subrecipient was provided the funding at the beginning of the grant award period and no required quarterly reports were submitted to the County subsequent to funding. Questioned costs: None. Context: Five out of the five subrecipients did not include required information in subaward agreements issued to subrecipients and lacked evidence of both the evaluation of risk of noncompliance of the subrecipient and monitoring of annual audits for the subrecipients. Two of the five subrecipients were missing an internal checklist that is signed by the County Manager. One of the five subrecipients was provided the funding at the beginning of the grant award period and no required quarterly reports were submitted to the County subsequent to funding. Cause: Lack of sufficient controls in place to ensure that subrecipient agreements contain all required information and are monitored appropriately. Effect: Failure to communicate required information and to adequately monitor the subrecipients could result in subrecipients not properly administering the federal programs in accordance with federal regulations. Repeat Finding: No. Recommendation: We recommend that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures in place to ensure the required certifications for covered contracts and subawards are received, documented, and contracts are not made with a debarred or suspended party. Condition: During our testing of five covered transactions (three vendors and two subawards), we noted all three vendors did not have proper supporting documentation for suspension and debarment procedures for vendors. Questioned costs: None. Context: Three of the five covered transaction tested did not have proper supporting documentation for suspension and debarment procedures. Cause: One of the vendors was added as a contractor and two of the vendors were added as subcontractors in an amendment with an existing contractor. Since this was an amendment made subsequent to the original procurement activity, these vendors were overlooked for suspension and debarment procedures. Effect: Failure to obtain the required certifications or perform verification procedures with the SAM could result in the payment of federal funds to vendors that are suspended or debarred from participation in federal assistance programs. Repeat Finding: No. Recommendation: We recommend the County obtain certifications from vendors stating their organization is not suspended, debarred, or otherwise excluded from participation in federal assistance programs or document the procedures performed to verify the vendor is not identified as suspended or debarred on SAM. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: 2 CFR 200.302(b)(3) indicates that records that adequately identify the source and application of funds for federally funded activities are necessary. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income, and interest and be supported by source documentation Condition: Expenditures originally reported on Schedule of Expenditures of Federal Awards included non-federal amounts. Questioned costs: None Context: Expenditures reported on the Schedule of Expenditures of Federal Awards for Assistance Listing Number 21.019 were overstated by $128,744. Cause: Pueblo County used revenue as a basis for claiming expenses. Effect: Expenditures reported on Schedule of Expenditures of Federal Awards included non-federal amounts. This was corrected for final Repeat Finding: No. Recommendation: CLA recommends the County implement tracking procedures to ensure only federal expenditures are reported on the Schedule of Expenditures of Federal Awards. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: Department of Homeland Security Federal program title: Chemical Stockpile Emergency Preparedness CFDA Number: 97.040 Pass-Through Agency: Colorado Department of Emergency Management Pass-Through Number(s): 14CESP14PC, 15CESP15PC, 16CESP16PC, and 17CESP18PC Award Period: June 17, 2020 - September 30, 2021 Type of Finding: Significant Deficiency in Internal Control over Compliance, Noncompliance, Other Matters Criteria or specific requirement: 2020 Compliance Supplement requires that procurement of goods and services are made in compliance with the provisions of the Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) and that no subaward, contract, or agreement for purchases of goods or services is made with any debarred or suspended party. Condition: County purchasing office did not check the System for Award Management (SAM) for vendor disbarment or suspension prior to purchase or contract approval. Questioned costs: None Context: CLA sampled 5 of 13 vendors. No vendor sampled had been checked for suspension or debarment prior to purchase or contract approval. Cause: Lack of internal controls over suspension and debarment procedures. Effect: Potential that payment of federal dollars to vendor who is suspended or debarred from receiving federal dollars. Repeat Finding: No Recommendation: CLA recommends implementing systematic tracking process for verifying all vendors have been reviewed within the System for Award Management (SAM) prior to payment approval. Views of responsible officials: There is no disagreement with the audit finding.

Finding 2019-005 Prior Year Finding Number: N/A Type of Finding: Internal Control over Compliance and Compliance Severity of Deficiency: Significant Deficiency Federal Agency: U.S. Department of Health and Human Services CFDA#: 93.778 ? Medicaid Cluster Pass-through Entity Colorado Department of Human Services Type of Compliance Requirement - Criteria: Allowable Costs/Cost Principles ? 2CFR ?200.303(a) Criteria or specific requirement: Internal control over personnel costs for federal award programs as indicated within the Uniform Guidance as indicated from the following excerpts: ?200.303(a) Internal controls. (a) The non-Federal entity must establish and maintain effective internal control over the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. ?200.430 Compensation ? personal services. (a) Compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. ? Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. (i) Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award? The County?s Personnel Policy Manual, Chapter 4 indicates the following: ?It is the employee's responsibility to sign his or her time record to certify the accuracy of all time recorded. The supervisor will review and then initial the time record before submitting it for payroll processing. In addition, if corrections or modifications are made to the time record, both the employee and the supervisor must verify the accuracy of the changes by initialing the time record.? Condition: We performed testing to determine whether County controls over payroll allocation were operating effectively. This test included the review of time sheets for employee?s whose time is allocated between multiple Federal programs. Certain time sheets were missing, affecting two specific programs, Medicaid and LEAP. It was also noted that none of allocation time sheets contained evidence of review or initial by a supervisor or department head, as required by County policy. Context: We selected a random sample of three months and reviewed all time sheets for the seven employees with time allocated to the Medicaid program, for a total sample of twenty-one time sheets. Three time sheets were missing for the month of October; September time sheets were incorrectly used to allocate October payroll, and this inaccuracy was not subsequently corrected. None of the time sheets reviewed were approved by a supervisor. Cause: There are no procedures in place to ensure that approved time sheets are provided to the accounting department on a timely basis. There are insufficient procedures in place to ensure that any necessary estimates are subsequently corrected to actual in the event approved time sheets are not available by payroll processing deadlines. Effect: Payroll expenditures were coded and charged to Federal programs that did not have the proper support as required by Uniform Guidance and County policy. Questioned Costs: The questioned costs related to payroll allocation totaled $8,621 in the Medicaid Cluster. There were no reportable questioned costs related to payroll allocation in the LEAP program. Recommendation: We recommend the County establish controls to ensure time sheets are received each month on a timely basis for every employee whose time is allocated between Federal programs, as applicable. In instances where time sheets are not received timely, the County should have procedures in place to adjust the payroll allocation in the subsequent month. In addition, these time sheets should be approved by both the employee and a supervisor or department head, and evidenced by a signed time sheet provided to the accounting department. Views of responsible officials and planned corrective actions: We agree with the above finding and have implemented an appropriate corrective action plan.

Finding 2019-006 Prior Year Finding Number: N/A Type of Finding: Internal Control over Compliance and Compliance Severity of Deficiency: Material Weakness Federal Agency: U.S. Department of Health and Human Services CFDA#: 93.778 ? Medicaid Cluster Pass-through Entity Colorado Department of Health Care and Policy Financing Type of Compliance Requirement - Criteria: Eligibility ? 2CFR ?200.303(a) Context: We performed testing on a statistical sample of sixty beneficiaries who were eligible for Medicaid during 2019, to determine whether those individuals? Medicaid eligibility determination was appropriate. In eighteen of the sixty Medicaid case files tested (approx. 30 percent), we identified at least one error with each case file. In total, we identified 20 errors within these 18 case files, as summarized in the following table. See a detailed description of errors noted in the paragraphs below. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR TABLE. Upon review of the most recently issued Comprehensive Annual Financial Report for the State of Colorado for the fiscal year ended June 30, 2019, and the accompanying Single Audit results, it was noted that the State of Colorado Department of Health Care Policy and Financing (HCPF) experienced similar issues with controls over Medicaid eligibility determinations. Per the single audit findings report, auditors identified errors in Medicaid case files that resulted in an error rate of approximately 26 percent. Errors identified involved case file documentation, income threshold and verification, data entry, and household composition. These results were due to caseworker error, as well as CBMS issues. The following results for the Pueblo County Medicaid program reflect similar results, as detailed below. Condition and Criteria or specific requirement: Internal control over eligibility determinations for federal award programs as indicated within the Uniform Guidance as indicated from the following excerpts: ?200.303(a) Internal controls. (a) The non-Federal entity must establish and maintain effective internal control over the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The following are details of errors identified, and the specific federal and/or state regulations to which the errors are related. ? Missing case documentation / Data entry and/or Caseworker error Seven case files were missing documentation necessary to support the Medicaid eligibility determination, specifically documentation to support income and resources, such as pay stubs, bank statements, tax statements, or vehicle registrations. In addition to missing documentation to verify resources, in three of these seven cases, the information in CBMS did not match the supporting documentation in the case file due to caseworker data entry error. Specifically, resources declared by the beneficiary were not entered, were not removed, or were duplicated in CBMS. In the remaining case, the caseworker did not verify income or resources, stating in case comments that due to the government shutdown in effect at the time of redetermination, verifications did not need to be obtained from the beneficiaries. After contacting officials at HCPF and Colorado Department of Human Services (CDHS), it was determined that these special directions were given in regard to SNAP or cash programs within CDHS, and were not applicable to Medical Assistance within HCPF. 42 CFR ? 435.914 ? Case documentation (a) The agency must include in each applicant?s case record facts to support the agency?s decision on his application. 10 CCR 2505-10 8.100.5.B. ? Verification Requirements. 1.c. Earned income may be self-declared by an individual and verified by the Income and Eligibility Verification System (IEVS). ? If a discrepancy occurs between self-declared income and IEVS wage data reports, IEVS wage data will be used to determine eligibility. 1.e. Verification of all resources shall be provided if the resources were available to the applicant in the month for which eligibility is being determined. ? Missing case documentation / CMBS interface error In one case, CBMS approved a beneficiary for SLMB benefits without verification of income and resources, or the case being reviewed by a caseworker. The case had not previously been reviewed by a worker, as the enrollment category within CBMS was SSI Mandatory. No annual redeterminations were sent, and as such, the case has been automatically re-enrolled in the system since 2012. 42 CFR ? 435.914 ? Case documentation (a) The agency must include in each applicant?s case record facts to support the agency?s decision on his application. 10 CCR 2505-10 8.100.5.B. ? Verification Requirements. 1.c. Earned income may be self-declared by an individual and verified by the Income and Eligibility Verification System (IEVS). ? If a discrepancy occurs between self-declared income and IEVS wage data reports, IEVS wage data will be used to determine eligibility. 1.e. Verification of all resources shall be provided if the resources were available to the applicant in the month for which eligibility is being determined. ? Missing Social Security Number / CBMS issue In one case, an automatic background operation within CBMS incorrectly deleted the SSN and changed the date of birth of the beneficiary. The case worker had correctly entered the SSN and date of birth upon receipt of the information from the client. CBMS interfaces are used to verify and monitor several components of eligibility, including citizenship and income. These interfaces are unable to run without a SSN and correct date of birth. Benefits provided to this beneficiary were not affected. 42 CFR ? 435.910 ? Use of social security number. (g) The agency must verify the SSN furnished by an applicant or beneficiary with SSA to ensure the SSN was issued to that individual, and to determine whether any other SSNs were issued to that individual. 10 CCR 2505-10 8.100.3.I. ? Additional General Eligibility Requirements. 1. Each person for whom Medical Assistance is being requested shall furnish a Social Security Number (SSN); or if one has not been issued or is unknown, shall apply for the number and submit verification of the application. ? Incorrect income / Data entry In three cases, the incorrect income amount was used to determine eligibility. In one case, the caseworker did not enter the beneficiary?s income amount as declared on the application. In another case, the caseworker incorrectly end-dated a beneficiary?s income in CBMS, causing the children on the case to be moved into the MAGI-Children enrollment category, rather than CHP+. In the final case, the caseworker did not correctly enter income date information, causing CBMS to ?fail? the beneficiary, when she was actually eligible for benefits. 10 CCR 2505-10 8.100.5.B. ? Verification Requirements. 1.c. Earned income may be self-declared by an individual and verified by the Income and Eligibility Verification System (IEVS). ? If a discrepancy occurs between self-declared income and IEVS wage data reports, IEVS wage data will be used to determine eligibility. ? Incorrect income / Household composition / Data entry In one case, the incorrect household composition and income amount was used to determine eligibility. Specifically, tax filing status and income information declared on the application was not entered correctly in CBMS. The beneficiary declared that she would file taxes and claim one dependent; CBMS showed the beneficiary as not filing. Self-declared income on the application was not entered in CBMS. 10 CCR 2505-10 8.100.4.E. ? Determining MAGI Household Composition. 1. MAGI household composition is based on the beneficiary?s tax filing status (for example, single, married filing jointly, or tax dependent) as declared on the application. 10 CCR 2505-10 8.100.5.B. ? Verification Requirements. 1.c. Earned income may be self-declared by an individual and verified by the Income and Eligibility Verification System (IEVS). ? If a discrepancy occurs between self-declared income and IEVS wage data reports, IEVS wage data will be used to determine eligibility. ? Incorrect income / CBMS issue In one case, the beneficiary was classified in the incorrect enrollment category due to a CBMS interface issue. The beneficiary?s enrollment category in CBMS was SSI Mandatory, however the beneficiary has never received SSI. Because the case is categorized as SSI Mandatory, no annual redeterminations were sent, and as such, the case has been automatically re-enrolled in the system since 2014. 42 CFR ? 435.948 ? Verification financial information. (a)(1) The agency must request information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Act, the Internal Revenue Service, the Social Security Administration, the State unemployment compensation laws? ? Household composition / Data entry / CBMS issues In four cases, incorrect household composition counts were used to determine eligibility. In one case, due to data entry error, the caseworker incorrectly entered a spouse?s tax filing status as dependent, rather than married filing jointly. This resulted in the spouse?s income not counting toward the income threshold used in determining eligibility and enrollment category. The remaining three cases appear to be the result of CBMS issues. In one case, the caseworker correctly entered the tax filing status information for all members of the household based on the information declared by the beneficiary, however, CBMS did not correctly determine Medicaid Budget Units (MBU) used to determine the enrollment category. In the final two cases, minors were the only household members on the cases; there were no adults claiming the children, and therefore no income was verified to determine the child?s eligibility. Annual redeterminations were sent and were not returned, and therefore, these cases were automatically re-enrolled by CBMS. 10 CCR 2505-10 8.100.4.E. ? Determining MAGI Household Composition. 1. MAGI household composition is based on the beneficiary?s tax filing status (for example, single, married filing jointly, or tax dependent) as declared on the application. Cause: ? Training, Monitoring, Reviews: The Pueblo Department of Human Services (DHS) did not adequately train caseworkers on issues specifically identified in our audit to ensure that the required documentation to support eligibility was maintained within the case file, information was entered correctly into CBMS, benefits were approved/terminated correctly, and beneficiaries were enrolled in the correct Medicaid program. Additionally, DHS did not adequately monitor caseworkers and perform adequate case reviews to ensure Medicaid eligibility determinations were appropriate and supported with adequate documentation. However, DHS did comply with State quality review reporting requirements, which requires the County to review a certain number of cases each quarter and report findings to HCPF. ? CBMS Issues: The DHS is required to determine applicant and beneficiary eligibility in accordance with eligibility requirements defined in the approved State Plan (42 CFR 435.10). As a designee of the Colorado Department of Health Care Policy and Financing (the State Medicaid Agency), the County is required to use, and is reliant upon, the Colorado Benefits Management System (CBMS) to assist with eligibility determination and ongoing case management. As detailed in the testing errors noted above, several errors resulted from CBMS issues, including issues with interfaces and background operations. Effect: It is the responsibility of the DHS to ensure Medicaid eligibility determinations are made appropriately and in accordance with state and federal regulations, in coordination with the operation of CBMS. Data entry errors, inadequate case file documentation, and CBMS issues resulted in approval of benefits to ineligible individuals, and approval of beneficiaries in the incorrect enrollment category, as applicable. Questioned Costs: There were no reportable questioned costs related to this finding, as these costs are not paid directly by the County and were not determinable by the County. Recommendation: ? Training, Monitoring, Reviews: We recommend the County establish additional procedures to ensure caseworkers are adequately trained in Medicaid eligibility and documentation requirements. We also recommend the County consider more extensive monitoring and review procedures to ensure Medicaid eligibility determinations and ongoing case documentation are appropriate. ? CBMS Issues: We recommend errors noted as a result of CBMS issues be presented to responsible officials at the Colorado Department of Health Care Policy and Financing, so that these issues can be resolved to ensure proper determination of beneficiary eligibility going forward. Views of responsible officials and planned corrective actions: We agree with the above finding and have implemented an appropriate corrective action plan.

GSA_MIGRATION

GSA_MIGRATION