State of Utah

2024-003. Incomplete Pharmacy Rebate Reporting and Invoicing (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.778 Medicaid Assistance Program Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DHHS did not report all required pharmacy rebate information or send all rebate invoices to manufacturers within the statutory timeframe. Federal regulations (42 USC 1396r-8) require DHHS to report drug utilization data, including those in the managed care plans, to drug manufacturers and to invoice for rebates within 60 days after the end of each rebate period (typically a calendar quarter). DHHS contracts with a third-party organization to perform these processes of reporting and invoicing. After DHHS implemented a new claims system (PRISM) in April 2023, certain data would not properly interface with the third party’s system. Without receiving all the data, the third party was not able to report this data and send rebate invoices to the manufacturers. As a result, DHHS was not compliant with the requirements. Furthermore, DHHS did not communicate these issues to the Centers for Medicare and Medicaid Services (CMS) or obtain a waiver for the requirements. The unreported data relates to an estimated $86.3 million in rebates manufacturers owed DHHS in fiscal year 2024. DHHS plans to request these payments once the interface issues are resolved. Recommendations: We recommend that DHHS ensure: • Interface issues with third-party organization system are resolved, • Invoice and collect the fiscal year 2024 unbilled rebates, • All required drug utilization data is reported to manufacturers within required time and rebates are invoiced in a timely manner, and • Any issues or delays are promptly reported to CMS.   DHHS’ Response: The Department agrees with this recommendation.

2024-004. Inadequate Procedures to Identify Healthcare Providers with Expired Licenses (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.775, 93.77, 93.778 Medicaid Assistance Program 93.767 Children’s Health Insurance Program Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DHHS did not ensure all eligible healthcare providers had active professional licenses. DHHS uses a provider eligibility system (PRISM) to track healthcare providers eligibility and to ensure only eligible providers received claim reimbursement. We sampled 68 providers in PRISM that were listed as eligible and noted that five of these providers had expired licenses. All 68 sampled providers are eligible for the Medicaid program, while 42 of the 68 sampled providers are also eligible for the Children’s Health Insurance Program (CHIP). All five providers with expired licenses were Medicaid eligible, and two of them were also CHIP eligible. Federal regulations (42 CFR 455.412) require that DHHS “must confirm that [a] provider’s license has not expired.” DHHS works with the Division of Professional Licensing (DOPL) to track which providers have active licenses. On a weekly basis DOPL provides DHHS with a change report showing which licenses expired that week. DHHS then marks the associated providers as ineligible in PRISM. This process adequately addresses most expired licenses but was insufficient to detect the following issues. • Three providers were licensed in states other than Utah. DHHS allows out-of-state providers under certain circumstances, but because these providers were licensed in other states, they were not tracked by DOPL. DHHS did not have a process to check out-of-state licenses. These licenses expired between June 2017 and January 2022. • One provider had a license that expired during the COVID-19 Public Health Emergency (PHE). As instructed by CMS, DHHS temporarily ceased removing any providers during the PHE, and since the DOPL reports only cover changes for a weekly period, DHHS did not detect the issue at the end of the PHE. The provider’s license had been expired since January 2022. • One provider had initially been granted eligibility in the DHHS provider eligibility legacy system that preceded PRISM. When DHHS transferred provider files from the legacy system into PRISM in 2016, the associated licenses were not entered into PRISM until the first revalidation period. This provider was scheduled for a revalidation assessment in February 2021. However, this was extended to August 2024 due to the PHE. As a result, this provider’s license information had not yet been entered into PRISM and the change reports did not detect the issue. This license expired in January 2016. DHHS may have eventually detected these expired licenses during a revalidation process, but PHE- related extensions greatly increased the period of time before detection. PRISM has a function to detect and remove providers with expiring licenses, but DHHS did not use this function due to technical issues. Without an adequate system to detect license expiration, program funds may be paid to ineligible providers. DHHS did not reimburse any claims to these providers with expired licenses during fiscal year 2024. Recommendation: We recommend that DHHS ensure all healthcare providers listed as eligible have active professional licenses. DHHS’ Response: The Department agrees with this recommendation.

2024-005. Required Health and Safety Surveys Not Performed Within Statutory Timeline (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.778 Medicaid Assistance Program Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2023-008 DHHS did not perform required Health and Safety Surveys within required timeline. Federal regulations (42 CFR 442.15) require DHHS to conduct medical health and safety surveys for nursing and intermediate care facilities at least every 15 months. DHHS is also required (42 CFR 442.109) to ensure the statewide average interval between surveys is 12 months or less. We sampled 16 facilities and noted that DHHS had not conducted the required surveys within the statutory timeframe for 11 facilities. The statewide average interval was also greater than the allowed timeframe. The PHE and resulting relaxed requirements contributed to a backlog of surveys. Due to staffing shortages, DHHS has not yet resolved the backlog. If DHHS does not conduct these surveys, DHHS may be unaware if facilities do not comply with health and safety requirements, which could potentially endanger patients and cause program funds to be given to noncompliant facilities. Recommendation: We recommend that DHHS address the current survey backlog and conduct future surveys in a timely manner. DHHS’ Response: The Department agrees with this recommendation.

2024-006. TANF ACF-204 Report Does Not Match Supporting Documentation (Finding Type: Significant Deficiency) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.558 Temporary Assistance for Needy Families Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A Data elements for the Temporary Assistance for Needy Families (TANF) program submitted by DWS did not match the supporting documentation. The Annual Report (ACF-204) for the year ended September 30, 2023, had the following errors: These errors were caused by comparing the TANF data to incorrect supporting information in the preparation and not following the report instructions to prepare the report. The report review did not detect these errors. Federal regulations (2 CFR 200.303) require entities to “establish and maintain effective internal controls [procedures]…that provide reasonable assurance that the… entity is managing [federal program] in compliance with… terms and conditions of the federal award.” By not ensuring Reports match supporting information or not following report instructions, DWS is at risk of submitting inaccurate reports and failing to meet federal funding requirements. Recommendation: We recommend that DWS prepare and review all report lines to correct supporting documentation to ensure accuracy prior to submitting the reports. DWS’s Response: DWS agrees with the finding.

2024-007. Refugee Grant Expenditures Charged Outside Award Period (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance Federal Award Number: 2401UTRCMA-02 Questioned Costs: $39,297 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A We identified 8 of 33 (24%) transactions totaling $39,297 that were charged to the Refugee Cash Medical Assistance (CMA) award for federal fiscal year 2024 before the award began on October 1, 2023, the beginning of the award’s period of performance for allowable costs. 45 CFR 75.309 states that “a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance.” These costs were improperly allocated to the CMA award during the report preparation process and DWS’s review of the allocated transactions did not prevent or detect and correct these expenditures to ensure they were charged to the proper award period based on when the costs were incurred. Expenditures charged outside of an award period are considered unallowable for that award and could lead to improper reporting of expenditures to the federal awarding agency. Recommendation: We recommend that DWS implement a more detailed and thorough review of incurred and paid costs to ensure expenditures are charged to an appropriate award during the allowable award period. DWS’s Response: DWS agrees with the finding.

2024-008. Non-Payroll Expenditures Did Not Receive Adequate Reviews (Finding Type: Significant Deficiency, Other) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: Research and Development Cluster (Various ALNs) Federal Award Number: Various Questioned Costs: None Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The University of Utah (University) did not perform adequate reviews on three of 40 non-payroll expenditures transactions selected for review from the Research and Development (R&D) Cluster projects. According to the University’s policies, non-payroll expenditures are required to have one or both of the following controls procedures to be performed: • Review and approval of individual expenditures by the R&D project’s Principal Investigator (PI), or other appropriate personnel, at the time of purchase. • Timely review and approval of monthly Management Reports by the R&D project’s PI, Account Executive (AE), or a designated alternate. Pursuant to University Policy 3-003, this “Evidence of Review should ordinarily be completed within one month of receipt of the management reports.” In addition, 2 CFR 200.303 requires non-federal entities to establish, document, and maintain effective internal controls to provide reasonable assurance that it manages the federal awards in compliance with federal requirements. Due to a lack of understanding of the importance of reviewing expenditures, as well as travel or technological issues, two expenditures were not reviewed in accordance with the University’s policy. Additionally, a clerical accounting error caused the third expenditure to be recorded in the wrong accounting period and it was not effectively reviewed to prevent the error. Without implementing proper controls, expenditures for unallowable activities or costs are more likely to be charged to federally funded projects without being detected and corrected. Recommendations: We recommend that the R&D project’s PIs perform the following as required by the University’s policy: • Review management reports and complete the evidence of review (EOR) process within the allotted time frame; and • Effectively perform review and approval of individual transactions. University’s Response: The University agrees with the finding.

2024-009. Unallowable Cash Medical Assistance Benefit Issuances (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance Federal Award Number: Questioned Costs: $3,583 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A In our review of 40 cash medical assistance (CMA) benefit payments for the Refugee and Entrant Assistance Program, we noted the following errors: These errors occurred due to a lack of effective internal control over the case management and its iterative eligibility determinations, and Eligibility Workers incorrectly evaluating and entering updated case information into the eREP System. 2 CFR 200.303 requires that “the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” If new information is discovered for a case but not properly evaluated, it could lead to further overpayments and underpayments and the misuse of federal funds. Recommendation: We recommend that DWS strengthen their internal control environment and continue to provide training and support to their Eligibility Workers to ensure that case information is properly evaluated and correctly entered into the eREP System. DWS’s Response: DWS agrees with the finding.

2024-010. HTF Project Does Not Meet Eligible Income Requirements (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of Housing and Urban Development Assistance Listing Number and Title: 14.275 Housing Trust Fund Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A During eligibility reviews, DWS did not detect that a tenant in a Housing Trust Fund (HTF) assisted unit did not meet the income requirements to occupy the HTF-assisted unit. This error occurred because the tenant’s income was entered as $17,115 instead of $18,115 actual reported income, which exceeds the income limitation for this location of $17,400. The review by DWS also did not identify that this apartment complex did not have the specified one, two, and three-bedroom units available for HTF-assisted occupancy as outlined by the deed restrictions for this HTF-constructed apartment complex. Borrowers that are not in compliance with these deed restrictions could face DWS opting to call and make payable in full the HTF loan. 2 CFR 200.303 requires that “the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Without effective internal controls, ineligible tenants may be allowed to occupy HTF-assisted housing, thus limiting the availability of units for eligible extremely low-income families. Recommendation: We recommend that DWS strengthen its internal control to better determine that all HTF assisted housing units contain only income eligible tenants. DWS’s Response: DWS agrees with the finding.

2024-011. DWS-Adopted Guidelines Not Followed When Evaluating an Applicant Housing Project (Finding Type: Significant Deficiency, Other) Federal Agency: Department of Housing and Urban Development Assistance Listing Number and Title: 14.275 Housing Trust Fund Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DWS did not adhere to its adopted guidelines when assessing a housing project’s application for funding from the Housing Trust Fund (HTF). Per 24 CFR § 92.250, “Before committing funds to a project, the participating jurisdiction must evaluate the project in accordance with guidelines that it has adopted.” The Olene Walker Housing Loan Fund (OWHLF) Board approved the project for funding on April 28, 2022. Pursuant to OWHLF 2022 guidelines, DWS should have obtained with the project’s application “either certified or independently-audited financial statements for the developer.” DWS relied on a developer’s compilation report that does not provide any certification, assurance, or an independent opinion on audited financial statements. Without a clear definition of certified financial reporting, DWS personnel evaluating the project believed that the compilation report containing the developer’s financial statements was certified. If DWS does not follow its own guidelines to receive and review certified or audited financial statements, the OWHLF Board may place greater reliance on the developer’s financial statements when considering whether to approve HTF funding. Recommendation: We recommend that DWS adhere to its adopted guidelines, clarify its guidelines regarding certified financial statements, and obtain and review all necessary documentation when evaluating projects’ applications for approval by the OWHLF. DWS’s Response: DWS agrees with the finding.

2024-012. Inadequate SLFRF Subrecipient Monitoring (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award Number: N/A Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2023-017 The Governor’s Office of Planning and Budget (GOPB), the prime recipient for the State and Local Fiscal Recovery Funds (SLFRF), and state agencies, including the Department of Natural Resources (DNR), and the Department of Environmental Quality (DEQ) did not adequately fulfill their subrecipient monitoring responsibilities. Communication of Key Federal Grant Information, Risk Evaluation, and Compliance Monitoring DNR and DEQ did not have adequate written policies and procedures, properly communicate key federal grant information, or evaluate subrecipient-risk for noncompliance to guide the monitoring for eight of the 11 selected subrecipients (two at DEQ and six at DNR), as required by 2 CFR 200.332(a) and 2 CFR 200.332(b) and (d). Subrecipient Single Audit Report Reviews For three of the four subrecipients selected (one at DEQ and two at DNR), DNR and DEQ did not adequately review their subrecipients’ Single Audit reports and findings to assess whether the subrecipients spent the funds appropriately. The agencies also did not have adequate controls to ensure their subrecipients’ Single Audit reports were monitored according to federal requirements. Uniform Guidance (2 CFR 200.332(d)(2)) requires a review of subrecipient Single Audit reports when they become available, as well as a follow-up to address any findings related to the applicable program. The errors noted above were a result of the agencies not fully understanding the nature of the funds they received, the extent of compliance requirements, and the nature of the subaward agreement relationships. DNR and DEQ have taken steps to implement controls over these areas but did not have the new procedures in place as of year-end. Failure to establish internal controls, adequately communicate key federal program information to subrecipients, and perform risk evaluation and monitoring procedures may result in the subrecipient’s noncompliance with federal fund requirements and potential misuse of federal funds. Recommendations: We recommend that GOPB, DNR, and DEQ do the following: 1. Gain an understanding of the subrecipient requirements and establish internal controls to ensure compliance with these requirements; 2. Establish written policies and procedures to ensure compliance with subrecipient monitoring requirements; 3. Communicate all required federal award information to sub-recipients, 4. Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward; and, 5. Monitor subrecipients according to their assessed risk and as required by 2 CFR 200.332. DNR’s Response: The Department of Natural Resources agrees with this finding. We were originally audited by the State Auditor's Office in the summer of 2023 regarding our compliance with overseeing ARPA funding. In March 2024 we received findings from that audit. In May 2024 we were notified of an SLFRF audit. All of the new audit samples selected in the SLFRF audit were from before we received the results of the initial ARPA audit in March 2024. We have made improvements to our SLFRF subrecipient monitoring since receiving the initial audit recommendations in March 2024. We intend to make additional improvements based on these subsequent audit recommendations and our own internal reviews. DEQ’s Response: DEQ agrees with the finding. DEQ does have procedures for sub-recipient monitoring, including risk assessments and review of Single Audit reports; however, with the ARPA funds in question, improvements can be made to ensure that sub-recipient monitoring is performed timely, documented, and complies with federal requirements. GOPB’s Response: GOPB, DEQ and DNR agree with the finding. GOPB has proactively supported state agencies with their subrecipient monitoring responsibilities. On May 15, 2023, GOPB emailed the current version of its ARPA Reference Guide to all state agencies administering ARPA SLFRF funds. This guide provides a comprehensive overview of the necessary compliance documents, including the State Agency Checklist, guidelines for SLFRF administrative and indirect costs, Single Audit compliance standards, internal controls references, risk assessment protocols, and subrecipient monitoring checklists. Following this, GOPB hosted federal funds compliance training for agency financial management staff on May 31 and June 6, 2023, which covered key aspects of SLFRF oversight, such as the ARPA Reference Guide, Unique Entity ID (UEI) requirements, FINET ARPA coding, and compliance procedures. GOPB also reviewed ARPA SLFR frequently asked question 13.15 to document the requirements of 2 C.F.R. Part 200 that apply to non-revenue replacement projects and those that do not apply to revenue replacement projects. GOPB has also developed and implemented an APRA SLFRF Monitoring Plan to review agency compliance with policies, procedures, and subrecipient monitoring requirements.

2024-013. Misunderstanding Caused Improper Spending of Coronavirus State and Local Fiscal Recovery Funds (SLFRF) (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award Number: N/A Questioned Costs: $559,900 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The Governor’s Office of Economic Opportunity (GOEO) erroneously recorded $559,900 of expenditures to the SLFRF program. Sections 602(c)(1)(A-D) of the Social Security Act establish which types of projects recipients may use these funds for. The expended funds did not meet any of the criteria of those sections, and we question these costs. After bringing this error to GOEO’s attention, GOEO made an adjustment in fiscal year 2024 to reverse the expenditures so that $559,900 is no longer charged to the SLFRF program. This error occurred due to an inexperienced financial analyst using incorrect account coding for these transactions. The individual who normally approves these types of transactions was unable to review these transactions to detect and correct the coding error, and the substitute individual who performed the review did not detect and correct the error before approving the transactions. Recommendation: To ensure expenditures charged to SLFRF projects comply with requirements, we recommend GOEO: 1. Improve its oversight and monitoring of expenditures. 2. Establish effective internal controls.   GOEO’s Response: GOEO agrees with the finding. These expenditures are no longer recorded as charged to the SLRF program. GOPB’s Response: GOPB agrees with the finding. We acknowledge that GOEO mistakenly recorded $559,900 of expenditures to the SLFRF program and identified the same error during the quarterly expenditure review process. Upon identifying this error, GOPB promptly addressed the issue with GOEO so that expenditures could be corrected in the financial system before the end of the FY 2024 closeout and the July 2024 quarterly ARPA SLFRF report.

2024-014. Errors in Coronavirus SLFRF Quarterly Reports (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award Number: N/A Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2023-018 GOPB did not accurately prepare and submit SLFRF quarterly financial reports. We noted the following discrepancies in the two quarterly reports tested: • GOPB did not report the required written justification for projects that have capital expenditures greater than $10 million to the Treasury. We identified one project (of the 20 sampled) above the $10 million capital expenditures threshold that had written justification on file but had not been reported to the Treasury at the time of our testwork. GOPB did not submit the written justification due to confusion regarding the application of the standard, which resulted in the department being noncompliant with the reporting requirement. • GOPB could not provide sufficient documentation to justify the reported “Total Obligations” for three of the 20 projects sampled. They relied on Departmental information and not source data (signed contracts, grant agreements, etc.). The difference in these amounts resulted in obligations being overreported on the January 2024 report by $1,445,437 and overreported on the April 2024 report by $3,107,197. The Treasury’s Compliance and Reporting Guidance for SLFRF outlines that recipients “should appropriately maintain accounting records for compiling and reporting accurate, compliant financial data, in accordance with appropriate accounting standards and principles,” as well as other key reporting requirements for capital expenditures. Recommendation: We recommend GOPB submit the written justification of the capital expenditures for projects over $10 million to the Treasury and rely on source data to accurately report required information on the quarterly reports. GOPB’s Response: GOPB agrees with the finding. In April 2024, GOPB hired an additional fiscal grant manager to primarily focus on documenting and reconciling obligations and expenditures. As part of this process, GOPB is collecting and reconciling contracts, grant agreements, interagency agreements, and other obligating documents for ARPA SLFRF projects.

2024-015. Reported Number of Homeowners Overstated (Finding Type: Significant Deficiency, Reportable Noncompliance) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Award Number: HAFP-0100 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The number of unique homeowners classified at or below 100% area median income (AMI) was overreported for all Homeowner Assistance Fund (HAF) quarterly reports submitted to the Treasury. For the two reports that we looked at, the errors were as follows: This error occurred as a result of misinterpreting information received from third parties used to fill out the report and a misunderstanding by both the preparer and reviewer of report requirements and thresholds. To be compliant with federal standards (2CFR 200.303), DWS “must establish and maintain effective internal controls over the award.” Compliance cannot be established without a thorough understanding of the requirements and how the data from third parties is aggregated. Without that understanding and proper reviews to detect and correct errors, DWS may continue to report incorrect data and may risk not meeting the targeted earmark for homeowners assisted with income less than 100% AMI. Recommendation: We recommend that internal control be strengthened so that compliance requirements and data received from others are properly understood before completing and submitting federal reports. DWS’s Response: DWS agrees with the finding.

2024-016. Working Capital Reserves in Excess of Federal Guidelines (Finding Type: Reportable Noncompliance) Federal Agency: Various Assistance Listing Number and Title: Various Federal Award Number: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2023-020, 2022-027, 2021-025, 2020-036; 2019-023; 2018-033; 2017-021; 2016-037; 2015-048; 2014-040; 2013-049; 2012 12-51; 2011 11-56 As of June 30, 2024, five divisions within the Department of Government Operations (DGO) held working capital reserves in excess of federal guidelines of at least the amounts that follow: The following divisions do not have excess reserves at the internal service fund level; however, the federal oversight agency requires them to be assessed at the service area level, which resulted in excess reserves as follows: 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days’ cash expenses for normal operating purposes in each internal service fund. For DTS, the federal oversight agency only allows 45 days. The excess reserves were due to the inherent difficulty of accurately estimating expenses when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend each division within DGO reduce excess working capital reserves within each of the respective funds or service areas. DGO’s Response: Division of Purchasing and General Services Cooperative Contract Management Fund – State Purchasing continues to decrease the administrative fees on state cooperative contracts as each contract expires and is rebid. This is a slow process since State Purchasing has nearly 1,300 cooperative contracts with an average 5-year term. With only about 20% of the contracts expiring each year, this is an ongoing and slow process. Although State Purchasing is allowed under law to collect up to a 1.0% administrative fee on each cooperative contract, currently the average administrative fee is 0.35%. The excess reserves are also being reallocated to other programs. These allocations are intended to both reduce the excess reserve balance and to create efficiencies within the division to better serve state agencies. Federal Surplus Property Fund – The excess reserves are to be used in relocating Surplus to the Taylorsville State Office Building in March 2025. Contact Person: Windy Aphayrath (waphayrath@utah.gov, 801-957-7138), Director, Division of Purchasing and General Services Anticipated Correction Date: June 30, 2025 Division of Finance Purchasing Cards Fund (P-Card) – The system implementation was completed at the end of calendar year 2024. State Finance is working to analyze the annual costs of the system, develop a cost allocation strategy between the travel and P-Card programs, and adjust travel rates to cover the travel program's ongoing costs. The P-Card program will then distribute any remaining P-Card rebates to state agencies respective to their spending, if applicable. This effort will eliminate any excess federal reserves in the P-Card fund by the end of fiscal year 2025. Contact Person: Allyson Branch (abranch@utah.gov, 801-597-3523), Assistant Director, Division of Finance Anticipated Correction Date: June 30, 2025 Division of Risk Management Workers’ Compensation Fund – The Division of Risk Management has received approval from the Utah Legislature to reduce rates for workers’ compensation in fiscal year 2026. This will take effect on July 1, 2025. The division will also request at the next Legislative session to reallocate excess reserves from the Workers’ Compensation Fund to the Property Fund. This will be completed by July 1, 2026. Contact Person: Rachel Terry (rachelgterry@utah.gov, 801-702-7445), Director, Division of Risk Management, Anticipated Correction Date: July 1, 2026 Division of Technology Services Communication Services – The Division has worked to reduce the excess reserves and has been successful in decreasing the balance compared to the previous year. In addition, the current year rate was calculated to continue decreasing the excess reserve balance. Next year rates have also been adjusted to further reduce the excess reserve balance. We are working to balance reductions in retained earnings while maintaining services until the products reach the end of their lifecycle. Network Services – The Division is estimating that excess reserves will decrease as a result of anticipated increases in expenses over fiscal years 2025, 2026, and 2027 to support the migration to a cloud-based platform. We will continue to monitor rates and expenses as the technology environment continually changes. Printing Services – The Division has set the current year rate to recover costs in order to reduce the excess reserves. The threshold for this program has a small limit for a product with a very high volume. Print demand this year has been low, and we are forecasting this to be fully corrected by the end of fiscal year 2025. Contact Person: Jake Hennessy (jakehennessy@utah.gov, 385-271-2301), Executive Finance Director, Department of Government Operations Anticipated Correction Date: June 30, 2025 Division of Human Resource Management Human Resources Field Services – A cost allocation plan was developed to better align expenses with the specific service area supported. Field Service rates were lowered for fiscal year 2025. We anticipate continuing to fine tune rates to bring the Field Service reserve balance down. Contact Person: John Barrand (jbarrand@utah.gov, 801-957-9350), Director, Division of Human Resource Management Anticipated Correction Date: June 30, 2025

2024-017. Working Capital Reserves in Excess of Federal Guidelines Public Employees Health Plan (Finding Type: Reportable noncompliance) Federal Agency: Various Assistance Listing Number and Title: Various Federal Award Number: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2023-021; 2022-028; 2021-026; 2020-039; 2019-026; 2018-036; 2017-023; 2016-039; 2015-050; 2014-042; 2013-050; 2012 12-53; 2011 11-58 As of June 30, 2024, the Public Employees Health Program (PEHP) held working capital reserves in excess of federal guidelines as follows below. 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes. The inherent difficulty of accurately estimating expenses led to excess reserves. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend that PEHP reduce excess working capital reserves to a level allowed by federal regulations. State Medical We agree the PEHP State Medical Program holds excess reserves above the 60-day allowance on June 30, 2024. Long-Term Disability We agree the PEHP Long-Term Disability Program holds excess reserves above the 60-day allowance on June 30, 2024. Medicare Supplement We agree the PEHP Medicare Supplement Program holds excess reserves above the 60-day allowance on December 31, 2023.

2023-003. USBE Did Not Properly Report All Required Subawards in the Federal Reporting System Utah State Board of Education (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of Agriculture Assistance Listing Number and Title: Child Nutrition Cluster (ALN 10.553, 10.555,10.556, 10.559, 10,582) Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A USBE did not properly report all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Federal regulations (2 CFR Appendix-A-to-Part-170 a) require that USBE “report each action that equals or exceeds $30,000 in Federal funds for a subaward.” We reviewed a sample of 40 Child Nutrition Program cluster (CNP) subawards to ensure that they were properly reported in FSRS. Of the 40 awards, 7 were not reported. The following table details the errors detected: (See text for table) If these errors were projected to the entire population, they would impact 178 subawards totaling $34,282,399. These errors were the result of problems with the data template USBE used to gather and submit the data. USBE personnel perform monthly reconciliations to ensure all subawards are properly uploaded to FSRS. However, the same template problems also impacted the review process, so USBE did not detect these issues. Incorrectly reported data could allow data users to reach improper conclusions which could alter decision making. Recommendation: We recommend that USBE ensure it accurately reports all first-tier subawards in a timely manner. USBE’s Response: The USBE agrees with this finding.

2023-004. Higher Education Emergency Relief Fund Quarterly Reports Not Reviewed for Accuracy Utah Tech University (Finding Type: Significant Deficiency) Federal Agency: Department of Education Assistance Listing Number and Title: 84.425E Higher Education Emergency Relief Fund (HEERF) Student Aid 84.425F HEERF Institutional Aid Federal Award Number: P425E201701, P425F201626, and P425M200131 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The University did not have a control procedure in place to ensure that its Higher Education Emergency Relief Fund (HEERF) quarterly reports were reviewed for accuracy. Federal regulations (2 CFR 200.303) require that entities “establish and maintain effective internal control…that provides reasonable assurance that the … entity is managing the Federal award in compliance with…terms and conditions of the Federal award.” However, University personnel did not subject the reports to a review and approval process because they did not realize the requirements applied to HEERF quarterly reports. The University should be aware that effective control requirements apply to all federally required reports. Lack of proper controls may result in inaccurate information to be reported without detection that may lead users to reach inappropriate conclusions and make improper decisions. Recommendation: We recommend that the University ensure all required reports of federal financial assistance programs are reviewed to ensure accuracy. University’s Response: We agree with the finding that there should have been secondary internal review of the quarterly HEERF reports. However, it should also be noted that the quarterly reports were carefully reconciled to ensure agreement with the University’s financial ledgers, and the underlying ledger transactions were subject to all pertinent internal controls and approval processes.

2023-005. Foster Care Eligibility Reviews Not Adequately Completed Utah Department of Health and Human Services (Finding Type: Material Internal Control Weakness) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.658 Foster Care Title IV-E Federal Award Number: 2201UTFOST 2301UTFOST Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2022-006 For 17 of 60 (28%) cases reviewed, there was no evidence that DHHS had reviewed the initial Title IV-E Foster Care eligibility decisions. Federal regulation 2 CFR 200.303 requires that “the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” In response to a prior year audit finding, DHHS hired an employee in January 2023 to complete the review of eligibility determination. However, the review only covered new cases initiated during the current year, but not the existing cases initiated in prior years. These existing cases have never been reviewed to ensure proper eligibility decisions were made. However, benefit payments were incurred and paid during the year. Given the large number of cases requiring eligibility decisions the current team receives, the control was not properly designed and implemented to complete these reviews in a timely manner. Unreviewed or untimely reviews of eligibility decisions could lead to improper eligibility determinations and inappropriate benefit payments. Recommendations: We recommend DHHS allocate sufficient resources to expand the existing review or modify the control to ensure eligibility decisions are reviewed in a timely manner. DHHS’s Response The department acknowledges the need for continuous effort on the internal control assessment and reasonable implementation for this area. Procedures exist and review was performed to assist with proper IV-E eligibility determination.

2023-006. Lack of Controls over Food Benefit Payments Utah Department of Health and Human Services (Finding Type: Material Internal Control Weakness) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 10.557 Women Infants & Children Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DHHS did not verify food benefit expenditure detail received from its third-party service organization, along with request for reimbursing program funds, to ensure expenditures were made for allowable activities and costs before making payment. Federal regulation 2 CFR 200.303 states that “the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” DHHS has controls in place to ensure that benefit distribution information, such as eligible participants and food plans, is properly sent to its third-party service organization. However, DHHS did not verify the third-party service organization’s expenditure details to ensure that benefit payments made were in compliance with the allowable costs and allowable activities requirements before reimbursement. As a result, inaccurate, incomplete, or false payments may be paid without detection. Recommendations: We recommend DHHS establish a system of reviewing its third-party service organization’s expenditure details to ensure that program funds are paid for allowable activities and costs. DHHS’s Response: The department recognizes the need to review food benefit expenditure information received from the WIC third-party host processing vendor. WIC procedures are established which support proper performance for food benefit redemption.

2023-007. Noncompliance with Required Audit of MCO Encounter and Financial Data Utah Department of Health and Human Services (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 97.778 Medicaid Assistance Program (Medicaid Title XIX) Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2022-009 DHHS did not have a well-established process of recording or reviewing independent periodic audits of encounter and financial data for managed care organizations (MCO) as required in Federal regulation 42 CFR 438.602(e) & (g). Per Federal regulation (2 CFR 200.303), non-federal entities must “establish and maintain effective internal controls over the Federal award that provide reasonable assurance that the non-Federal entity is managing the Federal award in compliance with…terms and conditions of the federal awards.” DHHS performs periodic audits of all MCO Medical Loss Ratio (MLR) reports, and they incorrectly believed that the control they had in place was sufficient. The audits of MLR reports were found not to be independent audits of encounter and financial data as DHHS assumed. Therefore, there was no control or compliance occurring for the required audits. For fiscal year 2023 they started to implement corrections to contract out the periodic audits to a third-party auditor, but these audits were not yet complete. Recommendations: We recommend DHHS finish establishing a process to perform and post independent periodic audits as directed by Federal regulation 42 CFR 438.602(e) & (g) and establish an effective internal control over this new process. DHHS’s Response The Division of Integrated Healthcare (DIH), Office of Managed Healthcare (OMH) agrees with this finding and recommendation.

2023-008. Noncompliance with Timing of Health and Safety Surveys Utah Department of Health and Human Services (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.778 Medicaid Assistance Program Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A 12 of the 14 facilities sampled for Medicaid Health and Safety Surveys were performed between 18.63 months and 59.5 months, including 10 sampled facilities over 28 months, from the last survey date. Federal regulation 42 CFR 442.15 requires that surveys of facilities are to be conducted “to determine compliance with the requirements at a survey interval of no greater than 15 months.” According to DHHS, the surveys were backlogged due to the COVID-19 pandemic, in addition to a staffing shortage amidst a hiring freeze. The existing staff was unable to maintain regular certifications and address the backlog within the required timeline. If surveys are not completed, facilities could become noncompliant with health and safety requirements without detection, thus potentially endangering patients. Recommendations: We recommend DHHS create a plan to clear the backlog and maintain proper timing to complete the Health and Safety Survey. DHHS’s Response: The Division of Licensing and Background Checks (DLBC), Office of Licensing (OL) agrees with this finding and recommendation.

2023-009. Untimely Implementation of Provider Eligibility Requirement Changes Utah Department of Health and Human Services (Finding Type: Significant Deficiency) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.778 Medicaid Assistance Program Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DHHS did not properly review and approve 1 of 42 Medicaid provider applications reviewed during the audit. Per Federal regulations (2 CFR 455 Subpart E), providers must be screened, and their license and certifications must be verified before they are initially validated or revalidated. Effective July 1, 2021, requirements for Case Managers provider group were updated to require a Case Manager Certificate to be eligible for providing Medicaid services. Because DHHS did not implement the requirement in the system until June 15, 2022, the system did not have the proper criteria to determine provider eligibility during the period of delayed implementation. As a result, DHHS risks using Medicaid funds on ineligible providers. Recommendations: We recommend that DHHS implement procedures to ensure that eligibility requirements are implemented promptly after new eligibility requirements are announced by State Medicaid. DHHS’s Response: The Division of Integrated Healthcare (DIH), Office of Medicaid Operations (OMO) agrees with this finding and recommendation.

2023-010. Pharmacy Rebate Invoices Not Checked for Accuracy and Timeliness Utah Department of Health and Human Services (Finding Type: Significant Deficiency) Federal Agency: Department of Health and Human Services Assistance Listing Number and Title: 93.778 Medicaid Assistance Program Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A Pharmacy rebates invoiced quarterly in fiscal year 2023 were not reviewed to ensure invoices are accurate and sent in a timely manner within 60 days after the end of the quarter. According to Federal regulation 2 CFR 200.303, non-federal entities must “establish and maintain effective internal controls over the Federal award that provide reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and terms and conditions of the federal awards.” Although DHHS had sufficient internal controls over rebates in prior years, the control deficiency was a result of staff turnover during the year, combined with inadequate communication and training of the new staff. Lack of review may result in pharmacy invoices not sent in accordance with federal guidance. Recommendations: We recommend that controls be reinstated, and that the responsible employee be given proper training to correctly determine whether pharmacy rebates are reviewed for accuracy and timeliness. DHHS’s Response: The Division of Integrated Healthcare (DIH), Office of Financial Services (OFS) agrees with this finding and recommendation.

2023-011. Improper Acceptance of Materials Due to Lack of Effective Internal Controls Over the Quality Assurance Program Utah Department of Transportation (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of Transportation Assistance Listing Number and Title: 20.205 Highway Planning and Construction Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A 23 CFR Section 637 requires UDOT to follow an approved Quality Assurance Program (QAP) to assure the quality of materials and construction of all Federal-aid highway projects. For 7 of 40 (17.5%) items reviewed, the Resident Engineer accepted construction materials that were not tested in compliance with UDOT’s QAP as approved by the Federal Highway Administration. Section 1010-1015 of UDOT’s Materials Manual of Instruction describes UDOT’s QAP, and states that materials acceptance decisions for applicable materials must be based on manufacturer information, or sampling and testing procedures performed by qualified testing personnel. Qualified testing personnel must pass two independent assurance (IA) tests each calendar year for each certification area, and one test must be a split sample. In our testing of 40 accepted materials covered by the QAP, we noted the following errors: (see file for table) These erroneous acceptance decisions and the inconsistent applications of the QAP occurred because internal controls were not adequate to ensure UDOT personnel fully understood the elements of the QAP. The lack of understanding and the inconsistent application of the QAP could result in inferior construction materials and workmanship being accepted, paid for, and used on UDOT projects. Recommendation: We recommend that UDOT strengthen its internal controls to ensure that all relevant personnel are properly trained and familiar with the QAP requirements, and that they apply those requirements consistently. UDOT’s Response: Concur

2023-012. Noncompliance Resulting from the Failure to Implement Effective Internal Controls Over Value Engineering Program Utah Department of Transportation (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of Transportation Assistance Listing Number and Title: 20.205 Highway Planning and Construction Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A UDOT has not implemented effective internal controls over their Value Engineering (VE) Program to ensure VE analyses are properly performed on all applicable projects in accordance with federal requirements and UDOT policy and procedures. Consequently, UDOT was unable to provide evidence of the following VE program requirements: • VE analyses are being completed on all applicable projects; and • Proper documentation, assessment, and reporting of the completed VE analyses. 23 CFR Part 627.7a(5) “The [State Transportation Agency’s (STA)] VE program shall: Establish and document policies, procedures, and controls to ensure a VE analysis is conducted and all approved recommendations are implemented for all applicable projects administered by local public agencies; and ensure the results of these analyses are included in the VE program monitoring and reporting.” The issues noted above are the result of inconsistent staff training and inadequate resources to run the expanding VE program effectively. Without appropriate internal controls, VE may not be performed for all applicable projects and approved recommendations identified from VE may not be incorporated into the plans, specifications, and estimates of projects. Recommendation: We recommend that UDOT implement effective internal controls and ensure staff over their VE Program are properly trained and have adequate resources to ensure compliance with Federal requirements and UDOT policy. UDOT’s Response: Concur

2023-013. Improper Reimbursement of Utility Expenditures Due to Lack of Effective Internal Controls Utah Department of Transportation (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of Transportation Assistance Listing Number and Title: 20.205 Highway Planning and Construction Federal Award Number: Various Questioned Costs: $27,559 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A UDOT improperly reimbursed utility expenditures for two projects prior to the utility agreements being approved by UDOT and the utility company and prior to completion of the work. 23 CFR Section 645.113(g)(3)) requires a utility agreement to be approved prior to the utility incurring any costs or conducting any work that would be eligible for reimbursement. In addition, 23 CFR Section 645.107(a)) requires reimbursement of utility costs to occur after the work is completed. The expenditures on these projects were paid improperly because UDOT has not implemented effective internal controls over utility reimbursements, personnel did not fully understand the Federal reimbursement requirements, and the Utility companies required UDOT to pay for their costs upfront prior to performing any work. Due to improperly approving and reimbursing expenditures before requirements were met, we are questioning the associated costs for the two projects for the amount of $27,559. Recommendation: We recommend that UDOT implement effective internal controls and follow Federal requirements for the reimbursement of utility costs. UDOT’s Response: Concur

2023-014. Missing Documentation for Emergency Rental Assistance Payments Utah Department of Workforce Services (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of U.S. Treasury Assistance Listing Number and Title: 21.023 Emergency Rental Assistance (ERA) Programs Federal Award Number: N/A Questioned Costs: $4,450 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2022-019 Surveying a sample of 60 payments for the ERA program, two of the payments did not have documentation supporting the payment or had ineligible application costs associated with the recipient. Specifically, the errors were: • One application did not include correct income verification for $3,100 of rent payments, and included an unallowable future rent payment for a month-to-month contract. • One application did not include a signed stay agreement for a short-term stay in a hotel for a total of $1,350. The above errors did not meet the documentation and eligibility criteria established by federal statute (see section 501, Division N of the Consolidated Appropriations Act and Section 3201 of the American Rescue Plan Act). These errors occurred because the eligibility workers did not follow Department of Workforce Services (DWS) procedures for ERA and the DWS Processors’ review of these applications did not identify and correct the errors. This resulted in questioned costs of $4,450 out of the $119,910 of sampled payments. Subsequent to DWS’ initial eligibility determination and payment approval, DWS was able to obtain the missing supporting documentation for both of these applications from the individual and the hotel, which total $2,900 of the errors above. Recommendation We recommend that DWS require: • Eligibility workers to follow ERA procedures. • Program processors to review the applications for completeness and accuracy prior to disbursing ERA payments. DWS’ Response We agree with the finding.

2023-015. Obligation of CRF Funds Not Completed Within Proper Timeframe Governor’s Office of Planning and Budget (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.019 Coronavirus Relief Fund Federal Award Number: N/A Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A On August 3, 2022, the Governor’s Office of Planning and Budget (GOPB) obligated approximately $48 million of Coronavirus Relief Funds (CRF), seven months past the final obligation date of December 31, 2021. GOPB subsequently expended the funds on December 30, 2022, three months after the final obligation liquidation date of September 30, 2022 due to delays in FEMA reimbursements received after this date.¬¬ The US Department of the Treasury’s (Treasury) program guidance indicates payments from CRF “may only be used to cover costs that were incurred during the period that begins on March 1, 2020, and ends on December 31, 2021.” The Treasury further revised its definition of “incurred” as of December 14, 2021, to align with Uniform Guidance’s definition of obligation (2 CFR 200.1). This means an order should be placed for property and services or entering into contracts, subawards, and similar transactions that require payment by December 31, 2021 to properly obligate CRF funds. In addition, the Treasury’s revised guidance clarified that recipients “are required to expend their funds received from the CRF to cover these obligations by September 30, 2022.” Regarding FEMA reimbursements, the Prime Recipient Quarterly Grant Solutions Closeout Procedure Guide, which was issued by the Treasury Office of Inspector General (OIG) on February 14, 2022, states that “a prime recipient should refer to Treasury’s guidance when applying CRF proceeds, which are freed up as a result of FEMA’s 100 percent Federal cost share coverage, to other eligible uses under the CARES Act.” Facing the deadlines to close out CRF or lose funding, GOPB used the funds without appropriately adhering to the obligation and liquidation dates provided in the written guidance issued by the Treasury, including after-the-fact FEMA reimbursements. Failure to follow Treasury’s written period of performance guidance for timely obligation and liquidation of funds may jeopardize the use of funding and require repayment by the State. We considered GOPB’s use of the $48 million to ultimately be for eligible purposes under CRF’s allowable activities. As such, we did not question these costs. Recommendation: We recommend GOPB follow the Treasury’s written period of performance guidance with regard to obligation and liquidation of funds as it closes out the CRF program. GOPB’s Response: GOPB agrees with the basis for this finding. GOPB followed an alternative interpretation of the Treasury's CRF guidance regarding the use of CRF proceeds for costs incurred in response to correspondence with the U.S. Treasury. It was believed actions taken were reasonable based on that correspondence and Treasury’s Closeout Procedures Guide. After the enactment of the CARES Act, the Treasury Department updated guidance on costs incurred multiple times, including with the CRF Guidance Revision Regarding Cost Incurred on December 14, 2021. Based on a review of Treasury guidance and an email exchange between GOPB and the Treasury Office of Inspector General in September 2022, GOPB updated quarterly CRF reports to reallocate CRF proceeds freed up as a result of FEMA reimbursements to other eligible costs incurred prior to December 31, 2021. Those reallocated costs were incurred prior to December 31, 2021 and were eligible CRF obligations and expenditures, even if the state didn’t ultimately determine it would use CRF proceeds to cover those costs until the December 2022 reporting period.

2023-016. Underlying Accounting Data Does Not Support CRF Quarterly Reports Governor’s Office of Planning and Budget (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.019 Coronavirus Relief Fund Federal Award Number: N/A Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2022-024, 2021-020 The methodology used by GOPB to prepare and submit CRF quarterly financial reports did not ensure the complete and accurate reporting of expenditures as reflected in FINET, the State’s accounting system or “official record.” We selected the October 2022 and January 2023 report submissions to test key items on the reports as specified in the OMB Compliance Supplement. We were unable to determine the completeness of the line items as follows: October 2022 Report • Manual adjustments made to the original data totaled $98.3 million. January 2023 Report • Our reperformance of GOPB’s original query of FINET resulted in $68.2 million of expenditures more than data used in the preparation schedules. • Manual adjustments made to the data totaled $54.5 million. While manual adjustments, corrections, and other changes (i.e., FEMA reimbursements) are not unexpected in reports, we considered the following in relation to GOPB’s report preparation: • A reconciliation of the underlying accounting data and manual adjustments in the reports to the “official record” of CRF expenditures in FINET has not occurred. • Underlying accounting data was inconsistently coded from 2020 through 2023 but has not been reconciled to ensure all appropriate expenditures have been reported. • Manual adjustments include significant amounts of expenditures reimbursed by FEMA that may have been charged to both programs without detection. • Manual adjustments identified appear to report transactions within the period of performance, but underlying evidence indicates the obligation and liquidation occurred subsequent to period of performance dates in FINET. See Finding 1. • We could not properly test reported total cumulative obligations for either report because they were not properly documented. FINET does not track obligations and as such, reported obligations are manually included for reporting. • GOPB did not maintain appropriate internal control separation of duties between preparation and review. The Treasury’s guidance indicates that the “prime recipient’s quarterly Financial Progress Report submissions should be supported by the data in the prime recipient’s accounting system.” Additionally, the OIG FAQs on reporting and recordkeeping describe the need to correct errors or modifications in a timely manner and to report actual obligations and expenditures rather than estimates. GOPB relied on state agencies to properly code expenditures and to have a proper understanding of the appropriate use of funds. The data in FINET and expenditures reported drastically differed due to these coding differences and required manual adjustments that were not properly documented. GOPB personnel did not prioritize the reconciliation of FINET expenditures and obligations to those reported because of other duties, time constraints, and priorities. In addition to the failure to properly code and track expenditures, an untimely reconciliation and lack of appropriate separation of duties to prepare and review reports can lead GOPB to significantly misreport expenditures, misidentify errors, and miscalculate obligations of funds to be returned to the Treasury, if any. Recommendations: We recommend the following to GOPB: • Perform a reconciliation of reported and actual expenditures in FINET from fiscal years 2021 – 2023 as it closes out the CRF. • Perform a reconciliation of FEMA reimbursements with reported and actual expenditures to ensure expenditures were not charged to both programs. • Ensure adequate documentation of expenditures, obligations, and adjustments exist as part of closing out the CRF. GOPB’s Response: GOPB agrees with this finding. GOPB acknowledges that because of complexities in coding and tracking during fiscal years 2020 to 2023 and a ten-day federal reporting deadline, not all reported expenditures were reconciled before quarterly reports were submitted. Between July 2022 and January 2023, GOPB made significant progress by compiling and reconciling a master CRF expenditure file. After completing a final reconciliation for the September 31, 2023, CRF quarterly report, GOPB is confident every transaction reported to the Department of the Treasury, including adjustments for FEMA reimbursements and other recategorizations, is reconciled with FINET data.

2023-017. Failure to Implement SLFRF Subrecipient Monitoring Requirements Governor’s Office of Planning and Budget (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.027 Coronavirus State & Local Fiscal Recovery Funds Federal Award Number: N/A Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2022-026 GOPB, the prime recipient for the State and Local Fiscal Recovery Funds (SLFRF), and state agencies, including the Governor’s Office of Economic Development (GOEO), Department of Natural Resources (DNR), and Department of Environmental Quality (DEQ), did not adequately fulfill their subrecipient monitoring responsibilities for 53 agreements passing through nearly $105 million during State fiscal year 2023 as follows: Communication of Key Federal Grant Information, Risk Evaluation, and Compliance Monitoring GOEO, DNR, and DEQ did not implement adequate policies and procedures, properly communicate key federal grant information as required by 2 CRF 200.332(a), evaluate subrecipient risk, and monitor subrecipients for compliance as required by 2 CRF 200.332(b) and (d). From a sample of nine subrecipients, we noted the following: (see pdf for table) Subrecipient Single Audit Report Reviews GOPB did not review subrecipient Single Audit reports and findings for 2 of 3 sampled awards to assess whether the subrecipients spent the funds appropriately. GOPB did not have adequate controls to ensure its subrecipients’ Single Audit reports were monitored according to federal requirements. Uniform Guidance (2 CFR 200.332(d)(2)) requires a review of subrecipient Single Audit reports when they become available and a follow-up to ensure that any findings related to the applicable program are addressed. GOPB implemented a process to review Single Audit reports, but the control in place failed to identify all subrecipients that had Single Audit reports available for review. The errors noted above were a result of the agencies, including GOPB, not fully understanding the nature of the funds they received, the extent of compliance requirements, and the nature of the subaward agreement relationships. Failure to establish internal controls, adequately communicate key federal program information to subrecipients, and perform risk evaluation and monitoring procedures may result in the subrecipient’s noncompliance with federal fund requirements and potential misuse of federal funds. Recommendations: We recommend that GOPB work with other state entities like GOEO, DNR, and DEQ ensure an adequate understanding of the subrecipient requirements required by 2 CFR 200.332, including: 1. Establish appropriate internal controls and written policies and procedures to properly identify subrecipients and ensure compliance with subrecipient monitoring requirements, 2. Communicate all required federal award information to sub-recipients, 3. Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward, and 4. Monitor subrecipients according to their assessed risk. GOPB’s Response: GOPB agrees with this finding. This is a repeat finding from the 2022 single audit because there was insufficient time to implement the previous corrective action plan between the release of the audit and end of fiscal year 2023. GOPB has taken proactive measures to support state agencies in meeting their monitoring obligations after concerns were identified during the 2022 single audit. On May 15, 2023, GOPB distributed an email communication containing the ARPA Reference Guide to all state agencies responsible for administering ARPA SLFRF funds. This guide serves as a detailed resource outlining essential compliance documents necessary for effective implementation and monitoring of SLFRF programs. The ARPA Reference Guide includes a range of compliance documents, including the State Agency Checklist, SLFRF Administrative and Indirect Costs Eligibility, Single Audit Compliance guidelines, Internal Controls Reference Guide, Risk Assessment Checklist, Agreement Checklist, and Subrecipient, Beneficiary, and Contractor Checklist. On May 31 and June 6, 2023, GOPB provided federal funds compliance training to agency financial management staff to cover various topics crucial to SLFRF oversight, including the ARPA Reference Guide, Unique Entity ID (UEI), FINET ARPA Coding, Agency Checklist, and Agency Reviews. As outlined in the Final Rule FAQ 13.15, projects categorized under Expenditure Category 6, also known as “Revenue Replacement,” are exempt from some provisions in uniform guidance. Some of the projects sampled during the audit, including a portion of the projects managed by the Governor’s Office of Economic Opportunity (GOEO) and GOPB, fall under the revenue replacement category.

2023-018. Underlying Accounting Data Does Not Support Coronavirus SLFRF Quarterly Reports Governor’s Office of Planning and Budget (Finding Type: Significant Deficiency and Reportable Noncompliance) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.027 Coronavirus State & Local Fiscal Recovery Funds Federal Award Number: N/A Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The methodology used by GOPB to prepare and submit Coronavirus State and Local Fiscal Recovery Fund (SLFRF) quarterly financial reports did not ensure the complete and accurate reporting of expenditures as reflected in FINET, the State’s accounting system. We selected the October 2022 and April 2023 report submissions to test key line items. We identified the following errors: October 2022 Report • Our reperformance of GOPB’s original data query of FINET resulted in $15.7 million of cumulative expenditures more than data used in the preparation schedules. • From a sample of 8 projects, we noted differences for 5 projects ranging from $54 thousand to $77.2 million between what was submitted on the quarterly report and the underlying accounting data. Current Expenditures and Current Obligations errors differed by a range of $54 thousand to $15 million that also impact Total Expenditures and Total Obligations. Additional differences ranging from $46.5 million to $77.2 million occurred only for Total Obligations and Total Expenditures. • GOPB erroneously reported its calculated Revenue Replacement amounts by swapping the Base Year General Revenue Amount ($16.8 billion) and the 2020 Actual General Revenue ($17.5 billion). April 2023 Report • Our reperformance of GOPB’s original query of FINET resulted in $5.0 million more cumulative expenditures than the data used in the preparation schedule. • Our comparison of GOPB’s preparation spreadsheet and the report show cumulative obligations were underreported by $2.7 million. • From a sample of 8 projects, we noted differences for 5 projects ranging from $1,200 to $47.4 million between what was submitted in the quarterly report and the underlying accounting data. Current Expenditures and Current Obligations errors differed by a range from $1,200 to $9.3 million that also impact Total Expenditures and Total Obligations. Additional differences ranging from $11.9 million to $47.4 million occurred only for Total Obligations and Total Expenditures. Additionally, we identified the following in relation to GOPB’s reporting activity: • GOPB’s compilation coding structure was either inconsistently or erroneously applied or manually adjusted and unsupported. • Prepared obligation and expenditure data did not match the submitted report data. • GOPB reported cash transfers exceeding $38 million as actual expenditures during the reporting periods. The transfers should have been reported as potential obligations only. The differences in expenditures described above include the actual expenditures made in the respective periods. • GOPB reported four projects with expected capital expenditures of $10 million or greater and did not have written justification included with the reports or on file. GOPB reported one project with expected capital expenditures between $1 million and $10 million and did not have written justification on file as required by Treasury for capital expenditures. The Treasury’s Compliance and Reporting Guidance for SLFRF outlines that recipients “should appropriately maintain accounting records for compiling and reporting accurate, compliant financial data, in accordance with appropriate accounting standards and principles” as well as other key reporting requirements for revenue replacement and capital expenditures. GOPB’s reported obligations, expenditures, and other key line items drastically differed due to the compilation methodology differences and manual adjustments that were not properly documented. Internal controls failed to prevent or detect and correct the differences. Failure to adequately compile, document, and report expenditures can cause a misrepresentation or misreporting of funds. Recommendations: We recommend GOPB do the following: 1. Develop and apply consistent methodology of report data compilation and preparation to ensure it agrees to underlying accounting information, 2. Maintain adequate documentation for reporting requirements including manual adjustments and capital expenditures, and 3. Establish appropriate internal controls to prevent or detect and correct material errors in reporting processes prior to submission to Treasury. GOPB’s Response: GOPB agrees with this finding. GOPB believes SLFRF reports were complete and accurate; however, GOPB acknowledges that it did not adequately update its SLFRF accounting code crosswalk or document all adjustments to allow for independent verification of the information reported.

2023-019. Suspension and Debarment Not Verified Before Awarding Contracts Governor’s Office of Planning and Budget (Finding Type: Significant Deficiency) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.027 Coronavirus State & Local Fiscal Recovery Funds Federal Award Number: N/A Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2022-022, 2021-022 Upon receiving a Coronavirus State and Local Fiscal Recovery Fund (SLFRF) allocation, the Utah Board of Higher Education (USHE) neither established internal controls to ensure compliance with federal suspension and debarment requirements for awarded contracts, nor did they verify whether contracted parties were suspended or debarred prior to contracting with the parties. The two contracts awarded by USHE out of 44 contracts reviewed statewide did not check for suspension and debarment requirements prior to the award. The Treasury’s Final Rule General provisions and the Interim Final Rule issued May 17, 2021 states that “payments from the…Funds…will be subject to the provisions of the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR part 200),” which includes suspension and debarment requirements (see 2 CFR 200.214). Uniform Guidance (2 CFR part 200.303) also requires non-federal entities to “establish and maintain effective internal control…that provides reasonable assurance that the non-federal entity [manages the program] in compliance with…terms and conditions of the federal award.” Given USHE’s inexperience with federal programs, USHE was unaware the suspension and debarment requirements were applicable to its program, and GOPB did not sufficiently communicate applicable federal program requirements. Failure to properly implement controls and review each contracted party for suspension and debarment could result in federally debarred entities receiving grant awards. Recommendations: We recommend GOPB assist agencies, including USHE, to gain an understanding of suspension and debarment requirements and establish effective internal controls to ensure compliance with these requirements. GOPB’s Response: GOPB agrees with this finding. This is a repeat finding from the 2022 single audit because there was insufficient time to implement the previous corrective action plan between the release of the audit and end of fiscal year 2023. In September 2022, GOPB distributed an ARPA Agency Checklist to remind those managing SLFR funds of compliance, monitoring, and reporting requirements, which included the requirement of monitoring for suspension and debarment. This checklist tool was not consistently used previously. A retroactive check was performed and no entities receiving federal funds had been suspended or debarred. Follow-up training on ARPA monitoring was done April 3 and June 7, 2023. GOPB also reviewed Final Rule FAQ 13.15 which clarifies that revenue replacement dollars have different subrecipient monitoring standards, including an exemption from suspension and debarment checks in 2 CFR 200.214.

2023-020. Working Capital Reserves in Excess of Federal Guidelines Department of Government Operations (Finding Type: Reportable Noncompliance) Federal Agency: Various Assistance Listing Number and Title: Various Federal Award Number: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2022-027, 2021-025, 2020-036; 2019-023; 2018-033; 2017-021; 2016-037; 2015-048; 2014-040; 2013-049; 2012 12-51; 2011 11-56 As of June 30, 2023, five divisions within DGO held working capital reserves in excess of federal guidelines of at least the amounts that follow: (see table in text) The following divisions do not have excess reserves at the internal service fund level; however, the federal oversight agency requires them to be assessed at the service area level, which resulted in excess reserves as follows: (See table in text) 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days’ cash expenses for normal operating purposes in each internal service fund. For DTS, the federal oversight agency only allows 45 days. The excess reserves were due to the inherent difficulty of accurately estimating expenses when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend each division within DGO reduce excess working capital reserves within each of the respective funds or service areas. DGO’s Response and Corrective Action Plan: Division of Purchasing and General Services Cooperative Contract Management Fund – Public entities in Utah rely on the Division of Purchasing and General Services (State Purchasing) to maintain the cooperative contract program to assist with public procurement in Utah. The usage of state cooperative contracts by public entities continues to increase yearly, resulting in a corresponding increase in the collection of administrative fees. State Purchasing continues to review contract administrative fees on state cooperative contracts as each contract expires and is resolicited. This is a slow process since State Purchasing has approximately 1,200 cooperative contracts that expire only every five years and are then resolicited. While State Purchasing is allowed under law to collect up to a 1.0% administrative fee on each cooperative contract, currently the average administrative fee is approximately 0.35%, a decrease of 18.6% from the average contract administrative fee in fiscal year 2022. The Division of Purchasing and General Services also continues to work with the Department of Government Operations executive leadership to request the Utah Legislature appropriate out a portion of the excess reserves in the Cooperative Contract Management Fund. The calculation of the federal portion of these transfers will be submitted to Cost Allocation Services for review and approval when these transfers are completed. Federal Surplus Property Fund- Surplus Property anticipated relocating by the end of fiscal year 2023 with the completion of the new Utah State Prison. Due to schedule changes, the new location for Surplus Property was not completed in time and the new anticipated relocation date is the end of fiscal year 2025. At the time of relocation, Surplus Property will use the excess reserve funds to move and furnish the new location, including replacing aged equipment. Division of Finance Purchasing Card Fund – State Finance is in the process of implementing a new travel and expense reporting system for all state agencies. This system will simplify travel approvals, travel reimbursements, and reduce the administrative burden for the purchasing card (P-Card) expense reports on state agency personnel. To cover system implementation costs, State Finance elected not to distribute the rebates received from U.S. Bank related to state agency P-Card spending for calendar years 2021, 2022, and 2023. Rebates were still sent to participating entities external to the primary government. The anticipated completion date for the new system is the end of the calendar year 2024. State Finance will then review annually the costs of the system, develop a cost allocation strategy between the travel and P-Card programs, and adjust travel rates to cover the travel program's ongoing costs. The P-Card program will then distribute any remaining P-Card rebates to state agencies respective to their spend. This effort should reduce and/or eliminate any excess federal reserves in the P-Card fund by the end of fiscal year 2025. Division of Risk Management Workers' Compensation Fund – The Division of Risk Management did not request an increase in rates for fiscal year 2024 for the Workers Compensation Fund. It is also anticipated that premiums for worker compensation insurance for fiscal year 2025 will increase. This increase will help bring this fund back into compliance. The Division of Risk Management will also reevaluate this program at the end of fiscal year 2024 to determine if a legislative request to transfer funds out and/or refund the federal portion of retained earnings is needed to reduce and/or eliminate the excess federal reserves remaining in this fund. Division of Technology Services Communication Services – The fiscal year 2024 Communication Services rate was set to under recover the cost of providing this service by $276,000. The fiscal year 2025 rate was also set to under recover the cost of providing this service by an additional $398,000. DTS plans to annually review and adjust rates and issue mid-year rebates, if necessary, to bring DTS Communication Services into compliance with federal excess reserve guidelines by the end of fiscal year 2025. Mainframe Services – This service will be coming to an end by fiscal year 2024. As this service ends, DTS will issue rebates of any remaining Mainframe Services retained earnings to the state agencies who used the system. Division of Human Resource Management Human Resources Field Services – During fiscal year 2023, the Division of Human Resource Management worked to better align expenses with the corresponding rate. A cost allocation plan was developed to accomplish this goal. As a result of that effort, the Human Resources Field Services rate was decreased, and the Payroll Services and Core Services rates were increased for fiscal year 2025. The Division anticipates that these rate adjustments will eliminate the excess reserves.

Public Employees Health Plan (Finding Type: Reportable Noncompliance) Federal Agency: Various Assistance Listing Number and Title: Various Federal Award Number: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2022-028; 2021-026; 2020-039; 2019-026; 2018-036; 2017-023; 2016-039; 2015-050; 2014-042; 2013-050; 2012 12-53; 2011 11-58 As of June 30, 2023, PEHP held working capital reserves in excess of federal guidelines as follows below. (see text for table) 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes. The inherent difficulty of accurately estimating expenses led to excess reserves. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendations: Depending on the business requirements, we recommend that PEHP reduce excess working capital reserves to a level allowed by federal regulations. PEHP’s Response: Long Term Disability We agree that the program holds working capital reserves more than the federal guidelines. State Dental We agree that the program holds working capital reserves more than the federal guidelines. Medicare Supplement We agree that the program holds working capital reserves more than the federal guidelines.

Food Commodity Shipments, Disbursements, and Inventory Not Tracked(Utah State Board of Education)Federal Agency: Department of EducationALN Numbers & Titles: 10.569 Emergency Food Assistance Program (Food Commodities)Federal Award Numbers: VariousQuestioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Utah State Board of Education (USBE) does not have procedures to ensure that food commodity shipments, disbursements, and inventory balances, as reported by its subrecipient, are properly tracked, accounted for, and reconcile to federal records. As a result, 123,923 cases of food, with a $52,875 estimated value, could not be accounted for when our audit compared fiscal year 2022 shipment and disbursement records. These discrepancies were subsequently reconciled by USBE, therefore we are not questioning the associated costs.As the prime recipient for the Food Distribution Cluster, USBE is required to ?maintain records to document the receipt, disposal, and inventory of commodities received? (7 CFR 251.10). It is also required to ?establish and maintain effective internal control [procedures]?that provides reasonable assurance that the ? entity is managing [the program] in compliance with?terms and conditions of the federal award? (2 CFR 200.303). Without such procedures, USBE will be unable to accurately track food commodity shipments, and may be liable for untraceable shipments (7 CFR 250.19).Recommendation:We recommend that USBE establish procedures to ensure that food commodity shipments, disbursements, and inventory balances are properly tracked, accounted for, and reconcile to federal records.USBE?s Response:The USBE partially agrees with this finding.

Federal Funds Received Were Not Disbursed or Refunded Within Required Timeframe(Utah State University)Federal Agency: Department of EducationAssistance Listing Number and Title: VariousFederal Award Number: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AFor one of the two tested advanced cash draws, Utah State University (University) did not disburse or refund $729,728 of $2,154,816 draw amount within required timeframe. 2 CFR 200.305(b) requires that payments methods must minimize the time elapsing between the transfer of funds from the United States Treasury?and the disbursement by the non-Federal entity? 34 CFR 668.162(b)(3) further requires that these advance funds be disbursed within three business days, but the University did not disburse or refund the advanced amount of $729,728 until over a month later. In addition, the advanced fund that the University held after three business days did not meet the excess cash tolerance criteria as stated in 34 CFR 668.166(b) as excess cash exceeded 1% of total fiscal year 2021 draws and was not fully disbursed within the next seven calendar days. Therefore, the University ?must return immediately?any amount of excess cash?? to the U.S. Department of Education (ED) as required by this federal regulation. This issue was the result of University personnel not monitoring advance cash draws to ensure they were disbursed or refunded within the required timeframe. Due to noncompliance with federal regulations, the ED could revoke the University?s permission to request funds on an advance basis. Because the excess cash was either disbursed or refunded to ED before year-end, no costs were questioned.Recommendation:We recommend that the University monitor the amount of advance draws and disburse or refund advance funds within the required timeframe.University?s Response:We agree with the finding.

Foster Care Eligibility Controls Not Completed in a Timely Manner(Department of Health and Human Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.658 Foster Care Title IV-EFederal Award Number: 2201UTFOST; 2101UTFOSTQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AFor 16 of 40 (40%) of cases reviewed, the State of Utah?s Department of Health & Human Services (DHHS) could not provide evidence that it had reviewed the initial Title IV-E Foster Care eligibility decision. 2 CFR 200.303 requires that ?the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? The control was not properly designed and implemented as only two people (one of which is only a part time worker with responsibilities for other programs) were working on reviews for all Foster Care cases. The available resources are insufficient to complete these reviews in a timely manner. Unreviewed or untimely reviews of eligibility decisions could lead to improper eligibility determinations and inappropriate benefit payments.Recommendation:We recommend DHHS provide sufficient resources to carry out the existing control or modify the control to ensure eligibility decisions are reviewed in a timely manner.DHHS?s Response:The Department concurs with this recommendation. The agency is in the process of building an integrated eligibility team and will increase its capacity by having three team leads and one support coordinator III to support the eligibility review process.

Annual Medicaid Eligibility Reviews Not Completed(Department of Health and Human Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.778 Medicaid Assistance ProgramFederal Award Number: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/ADHHS and DWS did not complete the annual Medicaid eligibility reviews for 3 of 60 cases sampled. In addition, it did not complete an asset verification for one of these 3 cases. As required by 42 CFR 435.916, states must:? renew MAGI-based determinations of eligibility once every 12 months and no more frequently;? renew non-MAGI based eligibility at least once every 12 months.Section 721-1.A.1.b.i of the Utah Medicaid Policy Manual requires that asset verifications be completed as part of these eligibility reviews. Question 10 of the COVID-19 Q&A within Medicaid Policy states that when an eligibility review is due during the emergency period, it should ?follow [the] normal review policy in section 721.? While DHHS did not complete these reviews because individuals could not be removed from programs during the public health emergency, individuals could have be moved to more appropriate programs if their income or household composition changes. The lack of regular reviews could result in Medicaid customers receiving coverage that does not match their needs and could also prolong individuals? ineligible participation in programs once the emergency period ends.Recommendation:We recommend that DHHS perform annual reviews and asset verifications in accordance with its policy.DHHS?s Response:The Department concurs with this recommendation. The Department will coordinate with the Department of Workforce Services (DWS) to whom we have delegated authority to perform eligibility determinations for Medicaid and CHIP and will ensure that DWS properly follows policy sections 721-1.A.1.b.i and COVID-19 Q & A question 10. DWS will train staff on proper use of the asset verification system, as well as remind staff on the review policy. DWS? Performance Review Team will also review a sample of cases to ensure compliance with these policies.DWS?s Response:We agree with the finding.

Use of Appropriate National Correct Coding Initiative (NCCI) Edit Files Not Verified(Department of Health and Human Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.778 Medicaid Assistance ProgramFederal Award Number: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/ADHHS did not verify its third-party contractor?s use of appropriate National Correct Coding Initiative (NCCI) edit files. 2 CFR 200.303 states that non-federal entities must ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with?terms and conditions of the federal award.? DHHS is required to use the most recent quarterly Medicaid NCCI edit files to ensure the proper payment of claims and to verify the correct edit files are used in processing claims. While DOH downloaded and sent the correct files to the third-party, it did not independently verify the third-party?s use of the updated edit files during the fiscal year. Because DHHS did not verify the use of the correct edit files, inaccurate, incomplete, or false claims could be paid.Recommendation:We recommend DHHS establish a system of regularly checking its third-party?s NCCI edits to ensure the correct edit files are used.DHHS?s Response and Corrective Action Plan:The Department concurs with this recommendation. The Division successfully created and tested a comparison file. The division will continue to work to resolve audit concerns. Implementation in production is set for November 2022.

Required Audits of MCO Encounter and Financial Data Not Conducted(Department of Health and Human Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.778 Medicaid Assistance ProgramFederal Award Number: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Department of Health and Human Services (DHHS) did not conduct or contract for independent periodic audits of Managed Care Organization (MCO) encounter and financial data and did not post audit results as required by 42 CFR Section 438.602(e) & (g). No independent audits of the necessary data have been performed or contracted to date. DHHS staff believed audits of the Medical Loss Ratio (MLR) satisfied federal requirements. However, the MLR audits do not attest to the ?accuracy, truthfulness, and completeness? of an MCO?s encounter and financial data. Unaudited encounter data not available to the public for review reduces the transparency in the Medicaid Program and causes noncompliance with federal requirements.Recommendation:We recommend DHHS either conduct or contract for independent periodic audits of MCO data and post the audit results in accordance with 42 CFR 438.602(3) & (g).DHHS?s Response:The Department concurs with this recommendation. The Department will coordinate with the Utah OIG to audit these encounters and/or conduct these periodic audits with Medicaid staff. The results will be posted on the Utah Medicaid website.

Medical Loss Ratio Report Lacked Two Required Elements(Department of Health and Human Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.778 Medicaid Assistance ProgramFederal Award Number: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AFor 1 of 2 Medical Loss Ratio (MLR) reports we reviewed, DHHS could not provide evidence that it had performed in a timely manner a review of the MLR report. Additionally, the MLR report did not contain two key reporting items. Specifically, the Pre-Paid Inpatient Health Plan (PIHP)?s MLR report was 1) missing the methodologies for the allocation of expenditures; and, 2) a signed attestation of accuracy. 42 CFR sections 438.8(k) and 438.8(n) require that ?the State must ensure that each. . . PIHP. . . submits a report with the data elements specified.? 2 CFR 300.303 also requires non-federal entities to ?establish and maintain effective internal control over the Federal award that provides reasonable assurance.? Inadequate reviews of MLR Reports may result in improper methodologies and inaccuracies in the MLR calculations to remain undetected.Recommendation:We recommend DHHS enforce the established internal controls over MLR reporting, and educate DHHS staff and Managed Care Plans of the Federal reporting requirements.DHHS?s Response:The Department concurs with this recommendation. The Department will ensure that all required elements of the MLR are received by having DHHS staff review elements of the MLR to ensure they are complete.

Sufficiently-Detailed PIC Meeting Minutes Not Maintained(Department of Health and Human Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.778 Medicaid Assistance ProgramFederal Award Number: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/ADHHS?s Program Integrity Committee (PIC) did not have well-documented meeting minutes showing the Office of Inspector General (OIG) reporting on utilization, fraud, waste, abuse, and recovery of Medicaid funds. 2 CFR 200.303 states that non-federal entities must ?establish and maintain effective internal control? that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with? terms and conditions of the federal award.? PIC meetings were established so DHHS and OIG would meet monthly and report on utilization, fraud, waste, abuse, and recovery of Medicaid funds. However, it was recorded in only one of the seven monthly PIC meeting minutes that OIG reported on the required items. Staff turnover led to poorly recorded meeting minutes, which can result in incomplete, inaccurate, or untimely reporting of Medicaid funds abuse.Recommendation:We recommend that DHHS maintain detailed meeting minutes for its PIC meetings.DHHS?s Response:The Department concurs with this recommendation. The MOU between OIG and DIH/Medicaid and the PIC bylaws define that meeting minutes will be taken with each PIC Committee. These meeting minutes will be reviewed at the following PIC Committee meeting and voted on for approval.PIC bylaws specifically state:?To keep written minutes of all Committee meetings, with assistance of staff, including:? Date, time, and place of meeting;? Names of members present, absent, and excused;? Substance of all matters proposed, discussed or decided and a record of votes taken;? Names of all other individuals who appeared and the substance in brief of their testimony;? Any other information that any member requests to be entered in the minutes.?

Subawards for SAPT Not Included in FFATA Reports(Department of Health and Human Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.959 Substance Abuse and Prevention TreatmentFederal Award Number: 6B08TI010052-19M0016B08TI083039-01M0046B08TI083479-01M0041B08TI083546-016B08TI084674-01M002Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/ADHHS did not have adequate controls implemented to ensure timely and accurate Federal Funding Accountability and Transparency Act (FFATA) reporting. None of the Substance Abuse and Prevention Treatment (SAPT) subawards with FFATA reporting requirements were reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Since DHHS was unable to provide a SAPT subaward list, we could not determine the number of subawards and associated dollar amounts that should have been reported in FSRS.2 CFR 200.303 requires that ?the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? 2 CFR 170 states that DHHS ?must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity.? The regulation further states that subaward information should be reported in FSRS ?no later than the end of the month following the month in which the obligation was made.? Failure to properly implement internal controls over reporting can lead to inaccurate reporting and noncompliance with Federal regulations.Recommendation:We recommend DHHS improve internal controls to capture applicable subawards in order to ensure accurate and timely FFATA reporting.DHHS?s Response:The Department concurs with this recommendation. We agree to properly report the subaward information beginning with SFY23.

Missing/Untimely Submissions and Errors in FFATA Reporting(Department of Workforce Services)Federal Agency: Department of EducationDepartment of TreasuryDepartment of Health and Human ServicesAssistance Listing Number and Title: 84.126 Vocational Rehabilitation21.023 Emergency Rental Assistance Program93.568 Low-Income Home Energy Assistance Program93.575, 93.596 CCDF ClusterFederal Award Number: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: 2021-006DWS did not have a control implemented to ensure timely and accurate Federal Funding Accountability and Transparency Act (FFATA) reporting. As a result we identified the following errors in our sample of six subawards across the four different programs.? Three subawards were not reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS);? The subaward obligation/action date for two reported subawards was inaccurately reported in FSRS; and? Three subawards were not reported timely in FSRS.These errors and the associated dollar amounts are summarized as follows: (See the Schedule of Findings and Questioned Costs for the table)2 CFR 200.303 requires that ?the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? 2 CFR 170 states that DWS ?must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity.? The regulation further states that subaward information should be reported ?no later than the end of the month following the month in which the obligation was made.? First-tier subrecipients and subawards should be reported and submitted on FSRS in a timely manner.Although DWS had designed an internal control over FFATA reporting, the control was not implemented because the COVID-19 pandemic delayed training for newly hired personnel to assist with the internal control. Failure to properly implement internal controls over reporting can lead to inaccurate reporting and noncompliance with Federal regulations.Recommendation:We recommend DWS implement internal controls to ensure accurate and timely FFATA reporting.DWS?s Response:We agree with the finding.

Inadequate Monitoring of Child Care Health and Safety Inspections(Department of Workforce Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.575 Child Care and Development Block GrantFederal Award Number: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/ADWS contracts with the state?s Department of Health and Human Services (DHHS) to perform Child Care Health and Safety inspections, but does not adequately monitor the results of these inspections. DWS attended 2 of the 7,489 child care provider inspections performed by DHHS Child Care Licensing personnel during fiscal year 2022, but did not review any of the remaining inspections to know whether the inspection occurred or the results of those inspections. DWS relied heavily on the agreement with DHHS to perform these inspections with minimal monitoring of DHHS?s performance. These health and safety inspections are required by 45 CFR section 98.41 and address specific areas such as first aid and CPR, safe sleeping practices, administration of medication, and child care worker training in these areas. The lack of proper monitoring could result in child care providers not meeting federal health and safety requirements.Recommendation:We recommend that DWS increase its monitoring of the inspection results to ensure the child care providers are meeting the required health and safety requirements required by 45 CFR 98.41.DWS?s Response:We agree with the finding.

Subrecipients Not Tracked for Monitoring of Single Audit Reports(Department of Workforce Services)Federal Agency: Department of Health and Human ServicesAssistance Listing Number and Title: 93.575 Child Care and Development Block GrantFederal Award Number: 2101UTCCDF, 21UTCSC6Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AFour of 26 entities receiving Child Care funds as a subrecipient were not included on DWS?s Single Audit tracking log. This log was reviewed and approved, but did not detect these missing subrecipients. 2 CFR 200.332(f) requires the DWS to ?verify that every subrecipient is audited as required by Subpart F? of Uniform Guidance. These entities were not included in the tracking log because the query used to pull Child Care subrecipient entities had an error in it. Because DWS did not identify the subrecipients for review, the subrecipients may not have been audited as required and follow up on findings related to DWS subawards may not have occurred as required. Potential internal control weaknesses or noncompliance at the subrecipient could occur without being detected by the DWS.Recommendation:We recommend DWS strengthen their internal controls to ensure query criteria to pull subrecipients is complete.DWS?s Response:We agree with the finding.

FFATA Award Information Not Submitted for UOVC?s 2020 Award & Inaccurate Information Submitted for 5 of UOVC?s 2019 Subawards(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeAssistance Listing Number and Title: 16.575 Crime Victim AssistanceFederal Award Number: 2019-V2-GX-00632020-V2-GX-0015Questioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AUtah?s Office of Victims of Crime (UOVC) did not submit Federal Funding Accountability and Transparency Act (FFATA) information for 13 awards to 13 subrecipients, all related to the 2020 award. In addition, 5 of the 28 grant awards we reviewed were reported in FSRS but the amounts reported did not agree to the subaward letters, with differences ranging from $34 to $405,000. We reviewed USASpending.gov and noted that no subrecipient award information for the 2020-V2-GX-0015 award had been submitted as of August 22, 2022 (the time of our audit). The following table summarizes the discrepancies for the transactions and subawards tested:(See the Schedule of Findings and Questioned Costs for the table)2 CFR 200.303 requires entities to ?establish and maintain effective internal controls [procedures]?that provide reasonable assurance that the ? entity is managing [federal program] in compliance with? terms and conditions of the federal award.? This control does not exist because managers both relied on an external control at the federal level to flag reporting issues and misunderstood reporting deadlines. Lack of FFATA reporting internal controls at UOVC results in noncompliance with grant requirements and reduces the transparency desired by the federal government.Recommendation:We recommend that UOVC implement controls over FFATA reporting and enter final award information rather than preliminary award information to ensure timely submission of accurate information.UOVC?s Response:UOVC Agrees.

Three SF-425 Quarterly Reports Not Reviewed for Accuracy Prior to SubmissionFederal Agency: Department of JusticeAssistance Listing Number and Title: 16.575 Crime Victim AssistanceFederal Award Number: 2018-V2-GX-00512019-V2-GX-00632020-V2-GX-0015Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: 2020-027, 2019-017, 2018-025For the 3 SF-425 reports selected, UOVC did not perform an independent review prior to submission, resulting in inaccurate amounts being reported in the reports. In UOVC?s efforts to improve its internal controls over the Crime Victim Assistance (CVA) grant, it received approval to fund a new financial manager position to act as a key control over CVA grant management. Because UOVC did not fill this position until June 2022, internal controls during fiscal year 2022 were insufficient in preventing or detecting and correcting errors in these reports. UOVC?s new financial manager should perform an independent review of SF-425 reports and ensure the information reported agrees to the underlying accounting records. Without such reviews, SF-425 reports may continue to include inaccurate information and would lead to noncompliance with reporting requirements.Recommendation:We recommend UOVC?s independent review verify the accuracy of the SF-425 reports.UOVC?s Response:UOVC Agrees.

Initial Eligibility Determination Not Documented for 3 SubrecipientsFederal Agency: Department of JusticeAssistance Listing Number and Title: 16.575 Crime Victim AssistanceFederal Award Number: 2018-V2-GX-00512019-V2-GX-00632020-V2-GX-0015Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AUOVC could not provide adequate documentation evidencing its controls over the determination of 3 subrecipients? eligibility. Standard UOVC procedures include the intake grant analyst?s review of a grant application, evidenced by the completion of an eligibility checklist. Subject matter experts then grade a subrecipient?s grant application based on the checklist. For 10 of the 13 subrecipients reviewed, the checklists were completed. For 3 of the 13 (23%), they were not. We did not question payments to the 3 subrecipients as we were able to determine they were eligible entities. Inconsistent application of standard UOVC procedures may result in incorrect eligibility determinations of subrecipients.Recommendation:We recommend UOVC comply with its standard procedures for subrecipient eligibility determination.UOVC?s Response:UOVC Agrees.

Missing Documentation for Emergency Rental Assistance Payments(Department of Workforce Services)Federal Agency: Department of TreasuryAssistance Listing Number and Title: 21.023 Emergency Rental Assistance ProgramFederal Award Number: N/AQuestioned Costs: $7,914Pass-through Entity: N/APrior Year Single Audit Report Finding Number: 2021-016Five of the 38 sampled payments (an error rate of 13.2%) for the Emergency Rental Assistance Program (ERA) did not have documentation supporting the payment or had ineligible costs associated with the recipient. Specifically,? Two applications contained utility payments that were paid for amounts higher than the utility bill,? One application did not include a management signed lease,? One application did not include a signed W-9 form and a management signed lease, and? An application did not include a written attestation from the applicant.The above errors did not meet the documentation and eligibility criteria established by section 501 of Division N of the Consolidated Appropriations Act, 2021, Pub. L. No. 116-260 (Dec. 27, 2020) and/or section 3201 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 (March 11, 2021).These errors occurred because the eligibility workers did not follow all of the Department of Workforce Services (DWS) ERA procedures and the DWS Processors? review of these applications did not identify and correct the errors. This resulted in errors of $7,914 of $80,671 in payments sampled from a population of $150,666,251.Subsequent to DWS?s initial eligibility determination and payment approval, DWS was able to obtain the missing supporting documentation for two of these sampled payments through requisition from the landlords, which total $7,824 of the errors above.Recommendation:We recommend that eligibility workers follow DWS ERA procedures and program processors review the applications for completeness and accuracy prior to disbursing ERA payments.DWS?s Response:We agree with the finding.

GOPB Overestimated Calculation for Revenue Loss Due to the Pandemic(Governor?s Office of Planning and Budget)Federal Agency: Department of the TreasuryAssistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery FundsFederal Award Number: N/AQuestioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Governor?s Office of Planning and Budget (GOPB) overstated its calculation for the State?s revenue loss experienced due to the Coronavirus pandemic for calendar year 2020 as follows: (See the Schedule of Findings and Questioned Costs for the Table)The Department of the Treasury (Treasury) issued its Interim and Final Rules (within the Federal Register) and related FAQs to guide governments in how to calculate the revenue losses experienced due to the pandemic. The Interim Rule instructs governments to identify ?general revenue? based largely on the Census Bureau?s definition and expands it to include or exclude certain revenue sources, which creates certain complexities and inconsistencies in the revenue loss calculation. After notification of the errors described above, GOPB revised its calendar year 2020 revenue loss calculation to $810,578,599. Differences between the auditor?s loss recalculation and GOPB?s revised amounts are a result of potential differing interpretations of Treasury?s revenue loss calculation guidance (e.g. hospital charges for providing patient services that may be covered by Medicaid or Medicare as a provider).GOPB calculated the revenue loss based solely on its personnel?s experience and understanding of revenue classification and did not account for the completeness, accuracy, and complexity of revenues and other financial information recorded by the State and the State?s institutions of higher education. Personnel in these areas who possessed the necessary understanding should have been involved in the calculation. Additionally, GOPB personnel charged with internal control responsibilities over the calculation did not possess the necessary expertise and knowledge to ensure compliance with Treasury?s Interim and Final Rules.GOPB?s oversight in these matters could cause material noncompliance with State and Local Fiscal Recovery Fund (SLFRF) requirements. Because Treasury?s guidance allows for reclassification of the excess expenditures, we have not questioned these costs. However, funds budgeted/obligated for future expenditures may not be available and may need to be revised.Recommendations:We recommend the following:? Review and revise cumulative expenditures and obligations/budgets to date to ensure the State?s plan for using the SLFRF allotment complies with Treasury guidance;? Resolve with Treasury the treatment of certain revenues and determine the impact on the State?s revenue loss calculation;? Ensure future revenue loss calculations follow Treasury?s guidance by utilizing the expertise and knowledge of key financial reporting personnel within the State and its institutions of higher education; and? Ensure individuals with internal control responsibilities over the calculation(s) possess the necessary understanding to ensure compliance with Treasury?s Interim and Final Rules.GOPB?s Response:GOPB agrees with this finding. GOPB agrees that the original August 2021 revenue loss calculation of $1,154,152,123 was incorrect due to incomplete reporting of revenue at the time of the calculation. GOPB personnel utilized the best information available at the time to complete this calculation. As more information has become available over the past 18 months it has become clear that the calculation needs to be done again. The revenue loss calculation was based on a calendar year, rather than a fiscal year and there were no official financial reports that could be used to compile the calendar year 2020 revenue totals at the time of the original calculation. GOPB had to rely on a combination of revenue data from the state?s financial system, FINET, as well as summarized revenue data from the financial systems used by institutions of higher education. When the original revenue loss calculation was completed in August 2021, financial reports had not been released for fiscal year 2021, which made it difficult to validate the calendar year 2020 general revenue reported by the institutions of higher education.

Improper Controls and Monitoring of State and Local Fiscal Recovery Funds Activity(Governor?s Office of Planning and Budget)Federal Agency: Department of the TreasuryAssistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery FundsFederal Award Number: N/AQuestioned Costs: $15Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AAs the prime recipient for the State of Utah, GOPB did not design and implement proper controls over allowable activities and costs.We identified 23 of 60 expenditures (38.3 percent failure rate) without proper internal controls to monitor compliance as shown below: (See Schedule of Findings and Questioned Costs for the table)We identified only one instance of noncompliance for a payroll expenditure of $15 from an expenditure sample of $9,794,539. We projected the error over an expenditure population of $147,219,149, resulting in $225 of projected questioned costs.According to the SLFRF Final Rule Federal Register, ?Recipients must establish rigorous oversight and internal controls processes to monitor compliance with any applicable requirements, including compliance by subrecipients.?GOPB and the Legislature centrally approved project plans and state agencies relied on that approval to ensure actual costs complied with the plan or SFLRF guidance. GOPB?s centralized project oversight and state agency reliance on GOPB?s approval of projects, combined with inexperience with federal compliance caused these unallowable expenditures. Poor internal control design could cause federal funds to be used for purposes not allowed.Recommendation:We recommend GOPB improve its oversight and monitoring of expenditures by working with agencies to establish internal controls that ensure expenditures charged to SLFRF projects comply with such requirements.GOPB?s Response:GOPB agrees with this finding. Prior to spending SLFR funds, agencies were required to document project eligibility and how expenditures would be coded in the state?s financial system, FINET. Agencies operating outside of FINET were required to provide similar coded expenditure data from their financial systems. GOPB maintains that agencies with extensive experience with federal funds, such as the Department of Health and Human Services, have adequate controls in place to ensure that only appropriate and eligible costs are charged to SLFRF accounting codes. Additionally, GOPB performs a quarterly review of all expenditures with SLFRF accounting codes before reporting these expenditures to the Treasury Department and authorizing the agency to book SLFRF revenue for those expenditures. While preparing the January 2023 report, GOPB added an additional step to have agencies review the quarter?s expenditures. Even with these processes and procedures in place, GOPB agrees that improvements can be made in the guidance, training, and follow-up with agencies managing SLFR funds, including checking for adequate controls that would catch errors charged to the grant.

Suspension and Debarment Not Verified Prior to Awarding Contracts(Governor?s Office of Planning and Budget)Federal Agency: Department of the TreasuryAssistance Listing Number and Title: 21.027 Coronavirus State & Local Fiscal Recovery FundsFederal Award Number: N/AQuestioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: 2021-022We identified 26 of 42 contract agreements sampled (61.9 percent error) where, under GOPB?s oversight, the state agency awarded SLFRF without verifying the entity was not suspended or debarred. These state agencies did not include a suspension and debarment clause in the contract with the entity as required by 2 CFR 200.327 or through a search of the suspension and debarment list on sam.gov: (See the Schedule of Findings and Questioned Costs for the table)2 CFR part 200.303 requires non-federal entities to ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity [manages the program] in compliance with?terms and conditions of the federal award.? At the time of the award, GOPB did not provide guidance to these agencies that were inexperienced with federal programs to be aware of the extent that the suspension and debarment requirements were applicable. Although our procedures did not detect noncompliance, failure to properly implement controls and appropriately review each contracted party for suspension and debarment could result in federally suspended or debarred entities receiving federal funds.Recommendation:We recommend GOPB assist agencies to gain an understanding of the suspension and debarment requirements and establish internal controls to ensure compliance with these requirements.GOPB?s Response:GOPB agrees with this finding. In September 2022, GOPB distributed an ARPA Agency Checklist to remind those managing SLFR funds of compliance, monitoring, and reporting requirements, which included the requirement of monitoring for suspension and debarment. This checklist tool was not consistently used. A retroactive check was performed and no entities receiving federal funds had been suspended or debarred.

Improper Spending and Monitoring of Coronavirus Relief Fund Activity(Governor?s Office of Planning and Budget)Federal Agency: Department of the TreasuryAssistance Listing Number and Title: 21.019 Coronavirus Relief FundFederal Award Number: N/AQuestioned Costs: $643,375Pass-through Entity: N/APrior Year Single Audit Report Finding Number: 2021-019Three of five Coronavirus Relief Fund (CRF) transactions tested for internal controls (60 percent) and three of 65 expenditures (4.6 percent) tested for compliance did not have adequate reviews to ensure the expenditures charged to CRF were in accordance with the Department of the Treasury (Treasury) guidelines. We have questioned costs of $643,375 for the following expenditures, which were not directly traceable in response to the public health emergency:? One transaction for the Thrive125 program celebrating Utah?s statehood in the amount of $271,334;? One transaction for an indirect allocation of limited liability and insurance in the amount of $4,524 (this was also originally included in the budget); and? A portion of one transaction for an IT contract payment totaling $367,517.Our sample totaled $47,280,705 and was taken from a population total of $108,519,500.As the prime recipient for the State of Utah, GOPB did not ensure the State?s CRF was spent in accordance with the Treasury guidance and FAQs. Treasury guidance stipulates the Fund may only be used to cover costs that 1) were necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19), 2) were not accounted for in the budget most recently approved as of March 27, 2020 (the date of enactment of the CARES Act) for the State, and 3) were incurred during the period that began on March 1, 2020 and ended on December 31, 2021.GOPB?s inadequate oversight of expenditures and state agency inexperience with federal compliance caused these unallowable expenditures and created an environment for federal funds to be used for purposes not allowed.Recommendation:We recommend GOPB improve oversight and monitoring of expenditures, especially of state agencies with less federal program experience, to ensure internal control over and compliance with CRF grant requirements.GOPB?s Response:GOPB agrees that documentation and monitoring could be improved. Documentation of the three questioned costs were not adequate enough to allow auditors to determine eligibility under CRF guidance. Nevertheless, GOPB believes the questioned costs will be determined eligible if examined by the Department of the Treasury, based on published guidance regarding economic support in connection with COVID?19, expenses for technical assistance, and administrative costs.As it relates to the first questioned cost, the Thrive 125 program provided economic assistance grants to businesses and organizations impacted by COVID-19. Utah?s creative arts industry, particularly performing artists, were significantly impacted by COVID-19. As part of the program, the grant recipients were required to provide free performances for the community, which enabled marketing opportunities for artists. This grant program underwent a CRF eligibility review, including discussions with the Unified Command Finance Group.With respect to the second questioned cost, when the state recognized the purchase order for the state?s COVID-19 dashboard was structured to allow for broader usage at no additional cost, the state decided to pilot several other dashboards. The purpose and eligibility of this expense was reviewed by the COVID Finance Steering Committee before it was funded with CRF funding.As for the third questioned cost, based on the final CARES Act CRF rule, GOPB agrees agencies are not permitted to apply indirect cost formulas for liability insurance. However, upon further review, $1,312 of the questioned $4,524 was already adjusted to be charged to a non-CRF funding source before the close of the fiscal year. The remaining $3,212 was directly related to the personnel who charged eligible time to the CRF and not based on an indirect cost formula. GOPB believes this would be a direct cost similar to workers compensation that is charged to employees each pay period.

Underlying Accounting Data Does Not Support Coronavirus Relief Fund Quarterly Reports(Governor?s Office of Planning and Budget)Federal Agency: Department of the TreasuryAssistance Listing Number and Title: 21.019 Coronavirus Relief FundFederal Award Number: N/AQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: 2021-020The methodology used by GOPB to prepare and submit CRF quarterly financial reports did not ensure the complete and accurate reporting of expenditures as reflected in FINET, the State?s accounting system. We selected the January 2022 and April 2022 report submissions to test key line items. We were unable to agree the following line items to FINET:January 2022 ReportManual adjustments made to the original data totaled $39.9 million.$10.96 million of the manual adjustments for small business bridge loans were reclassified as expenditures without the transaction occurring in FINET. Additionally, a significant portion of the loans should not have been reclassified as grants.April 2022 Report$5.4 million of expenditures less than data used in the preparation schedules.Manual adjustments made to the data totaled $65.4 million.While manual adjustments, corrections, and other changes (i.e., FEMA reimbursements) are not unexpected in reports, we considered the following in relation to GOPB?s report preparation:A reconciliation of the underlying accounting data and manual adjustments in the reports to the ?official record? of CRF expenditures in FINET has not occurred.Underlying accounting data was inconsistently coded from 2020 through 2022 but has not been reconciled to ensure all appropriate expenditures have been reported.Manual adjustments include significant amounts of expenditures reimbursed by FEMA that may have been charged to both programs without detection.FINET does not track obligations and as such, reported obligations are manually included for reporting. The reported total cumulative obligations in January of $933,976,723 and in April of $934,765,677 could not be tested because they were not properly documented.Treasury?s guidance indicates that the ?prime recipient?s quarterly Financial Progress Report submissions should be supported by the data in the prime recipient?s accounting system.? Additionally, the Treasury Office of Inspector General?s (OIG) FAQs on reporting and recordkeeping describe the need to correct errors or modifications in a timely manner and to report actual obligations and expenditures rather than estimates.GOPB relied on state agencies to properly code expenditures and to have a proper understanding of the appropriate use of funds. The data in FINET, the ?official record,? and expenditures reported drastically differed due to these coding differences and required manual adjustments that were not properly documented. GOPB personnel did not prioritize the reconciliation of FINET expenditures and obligations to those reported because of other duties, time constraints, and priorities. In addition to the failure to properly code and track expenditures, an untimely reconciliation can lead GOPB to significantly misreport expenditures, misidentify errors, and miscalculate obligations of funds to be returned to Treasury.Recommendation:We recommend GOPB perform timely reconciliation of reported expenditures to actual reimbursements to ensure reports are supported by the underlying accounting data and to make corrections and other necessary modifications occur in a timely manner.GOPB?s Response:GOPB agrees with this finding. GOPB acknowledges that because of complexities in coding and tracking during fiscal years 2020 to 2022 and a ten day federal reporting deadline, not all reported expenditures were reconciled before quarterly reports were submitted. Between July 2022 and January 2023, GOPB made significant progress by compiling and reconciling a master CRF expenditure file. After the final reconciliation is completed, GOPB is confident every transaction reported to the Department of the Treasury, including adjustments for FEMA reimbursements and other recategorizations, will be reconciled with FINET data.

CRF Subrecipient Single Audit Report Reviews Not Occurring(Governor?s Office of Planning and Budget)Federal Agency: Department of the TreasuryAssistance Listing Number and Title: 21.019 Coronavirus Relief FundFederal Award Number: N/AQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AGOPB did not design or implement controls to ensure its subrecipients? single audit reports were monitored according to federal requirements. It also did not review any subrecipients? single audit reports to assess whether its subrecipients receiving CRF funds spent the funds appropriately. 2 CFR 200.332(d) requires a review of subrecipient single audit reports when they become available. It also requires GOPB to follow up with the subrecipient to ensure timely and appropriate action has taken place for any deficiencies identified.GOPB did not design or implement controls because of its unfamiliarity with federal grant requirements and employee turnover. This could result in GOPB not identifying potential issues at the subrecipient level and take appropriate actions.Recommendation:We recommend GOPB establish policies and procedures to ensure monitoring of single audit reports occur in accordance with 2 CFR 200.332(d).GOPB?s Response:GOPB agrees with this finding. Prior to being awarded any CRF funds, GOPB required all subrecipients to agree to the terms and conditions on which the funds were granted. Part of the agreement stated that these federal funds were subject to the Single Audit Act and 2 CFR 200.332(d) requirements, which requires that subrecipients receiving more than $750,000 in federal funds per year complete and submit their single audit report in compliance with federal regulations. All state government agencies are covered under the statewide single audit completed by the Office of the State Auditor, however cities, counties, towns, water districts and other local entities are not covered by the statewide single audit and need to complete their own, if they meet the spending threshold.

Go Utah Did Not Implement Internal Controls for Subrecipient Monitoring Requirements(Go Utah)Federal Agency: Department of the TreasuryAssistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery FundsFederal Award Number: N/AQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Governor's Office of Economic Opportunity (Go Utah) did not establish internal controls to ensure compliance with Coronavirus State and Local Fiscal Recovery Funds (SLFRF) subrecipient monitoring requirements. Go Utah also did not properly communicate key federal grant information or evaluate and monitor its subrecipient for compliance purposes as required by 2 CRF 200.332.The Department of Treasury?s Final Rule requires recipients of funds to ?establish rigorous oversight and internal control processes to monitor compliance with any applicable requirements, including compliance by subrecipients.? 2 CFR 200.303 also requires the establishment of effective internal control for federal programs.Go Utah was unaware that subrecipient monitoring requirements were applicable to its program. Failure to establish internal controls, adequately communicate key federal program information to subrecipients and perform risk evaluation, and monitoring procedures may result in the subrecipient?s noncompliance with federal funds and potential misuse of federal funds.Recommendation:We recommend Go Utah:1. Gain an understanding of subrecipient requirements and establish internal controls to ensure compliance with these requirements; and2. Communicate all required federal award information to sub-recipients.Go Utah?s Response:We agree. While internal controls were insufficient, they were not completely absent. For example: (1) we implemented the American Rescue Plan Act of 2021 Appropriation Tracking and Documentation Form, and (2) all sub-recipients signed contracts that included internal controls such as requirements for status reports, performance measures, and compliance with all applicable federal and state laws, rules, and regulations.

Working Capital Reserves in Excess of Federal Guidelines(Department of Government Operations)Federal Agency: VariousAssistance Listing Number and Title: VariousFederal Award Number: VariousQuestioned Costs: UndeterminablePass-through Entity: NonePrior Year Single Audit Report Finding Number: 2021-025,2020-036; 2019-023; 2018-033; 2017-021; 2016-037; 2015-048; 2014-040; 2013-049; 2012-51; 2011-56As of June 30, 2022, four divisions within the Department of Government Operations (DGO) held working capital reserves in excess of federal guidelines of at least the amount that follows: (see the Schedule of Findings and Questioned Costs for the table)The following divisions do not have excess reserves at the internal service fund level, however, the federal oversight agency requires them to be assessed at the service area level, which resulted in excess reserves as follows: (See the Schedule of Findings and Questioned Costs for the table)2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days? cash expenses for normal operating purposes in each internal service fund. For DTS, the federal oversight agency only allows 45 days. The excess reserves were due to the inherent difficulty of accurately estimating expenses when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves.Recommendation:Depending on the business requirements, we recommend each division within DGO reduce excess working capital reserves within each of the respective funds or service areas or obtain a waiver for an increase in the number of days of working capital allowed to comply with federal guidelines.DGO?s Response:Division of Purchasing and General ServicesCooperative Contract Management ? Public entities in Utah rely on the Division of Purchasing and General Services (State Purchasing) to maintain the cooperative contract program to help with public procurement in Utah. The usage of state cooperative contracts by public entities increased dramatically this past year resulting in a corresponding increase in the collection of administrative fees. State Purchasing still continues to decrease the administrative fees on state cooperative contracts as each contract expires and is rebid. This is a slow process since State Purchasing has nearly 1,200 cooperative contracts that expire only every five years. Although State Purchasing is allowed under law to collect up to a 1.0% administrative fee on each cooperative contract, currently the average administrative fee is 0.38%. State Purchasing has also requested the Utah Legislature to appropriate out a portion of the excess reserves in this fund in fiscal year 2023. The calculation for the refund of the federal portion of this transfer out will be submitted to Cost Allocation Services for review and approval when this transfer is complete.Federal and State Surplus Property - Due to the completion of the new Utah State Prison, Surplus Property anticipates relocating by the end of calendar year 2023. At that time, Federal and State Surplus will need to use their working capital reserve funds for the costs of moving to and furnishing their new location. These additional expenses should eliminate these excess reserves by December 2023.Purchasing Cards ? The Division of Finance (State Finance) is in the process of implementing a new travel and expense reporting system for all State agencies to simplify travel approvals, travel reimbursements, and reduce the administrative burden for the purchasing card (p-card) expense reports on State agency personnel. To cover system implementation costs, State Finance elected not to distribute the rebates received from U.S. Bank related to State agency p-card spending for calendar years 2021 and 2022. Rebates were still passed through to participating entities external to the primary government. The anticipated completion date for the system is the end of calendar year 2023. State Finance will review annually the costs of the system, develop a cost allocation strategy between the Travel and P-Card programs, adjust travel rates to cover the travel program?s ongoing costs, and distribute any remaining p-card rebates to State agencies respective to their spend. This effort will reduce and/or eliminate excess federal reserves by the end of fiscal year 2024.Division of Risk ManagementWorkers? Compensation Fund & Property? We requested approval in the current legislative session to transfer $2,000,000 out of the Workers Compensation Fund and into the Property Fund. We will submit the calculation for the refund of the federal portion of this transfer to Cost Allocation Services for their review and approval when this transfer is completed. Additionally, in FY 2023, the premiums charged for workers compensation have been reduced 26% from $0.61 per $100 to $0.45 per $100. The property commercial insurance market and the Property Fund are experiencing enormous year-over-year premium increases. We have seen a doubling of premiums in the last five years, from $14,000,000 to $28,000,000. Additionally, the budget process requires that we project funding 1-2 years in advance before we can enact rate increases to pay the excess insurance premiums that are due each fiscal year. As such, we deem it important to maintain a retained earnings balance in the Property Fund to be able to sustain the Fund's ability to pay for increasing premiums.Division of Technology ServicesPrint Services ? DTS currently projects Print Services retained earnings will decrease by $181 thousand in fiscal year 2023. The Print Services rate was set lower than the cost to provide this service in fiscal year 2024. DTS plans to annually review and adjust rates and issue mid-year rebates, if necessary, to bring DTS Print Services into compliance with federal excess reserve guidelines by the end of fiscal year 2024.Communication Services - The fiscal year 2024 rate was set to under recover the cost of providing this service by an additional $425 thousand. Because the reductions to retained earnings were smaller than expected in fiscal year 2022 and are projected to be smaller than expected in fiscal year 2023, DTS will need an additional year to address this excess. DTS plans to annually review and adjust rates and issue mid-year rebates, if necessary, to bring DTS Communication Services into compliance with federal excess reserve guidelines by the end of fiscal year 2025.Network Services - DTS anticipates significant expenses to this product in fiscal year 2023 as DTS upgrades the aging network infrastructure and as the demand for network services continues to increase (e.g. Agencies are asking for increased bandwidth). Upgrades to the infrastructure have been more complex than originally estimated, which has delayed the majority of this expense to fiscal year 2023. DTS projects the Network Services retained earnings will decrease by nearly $1 million in fiscal year 2023. DTS plans to annually review and adjust rates and issue mid-year rebates, if necessary, to bring DTS Network Services into compliance with federal excess reserve guidelines by the end of fiscal year 2023.Mainframe Services - This product will be coming to an end by fiscal year 2024. As the product ends, DTS will issue a rebate to reduce retained earnings to the agencies using the system. DTS plans to issue a credit in fiscal year 2023 which will bring Mainframe Services into compliance.Division of Human Resource ManagementHuman Resources Core Services - The Division of Human Resource Management (DHRM) projects DHRM Core Services expenses to increase in fiscal year 2023 and future years. The DHRM Core Services excess reserves was the result of an error correction. In an effort to decrease these excess reserves, DHRM has not requested a rate increase for DHRM Core Services, though we do anticipate costs to increase. We will continue to annually review and adjust the DHRM Core Services rate and, if necessary, issue refunds or rebates to ensure DHRM Core Services is in compliance with federal excess reserve guidelines by the end of fiscal year 2024.

Working Capital Reserves in Excess of Federal Guidelines(Public Employees Health Plan)Federal Agency: VariousAssistance Listing Number and Title: VariousFederal Award Number: VariousQuestioned Costs: UndeterminablePass-through Entity: N/APrior Year Single Audit Report Finding Number: 2021-026; 2020-039; 2019-026; 2018-036; 2017-023; 2016-039; 2015-050; 2014-042; 2013-050; 2012 12-53; 2011 11-58As of June 30, 2022, the Public Employees Health Program (PEHP) held working capital reserves in excess of federal guidelines as follows below. (See Schedule of Findings and Questioned Costs for the table)2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days? cash expenses for normal operating purposes. The inherent difficulty of accurately estimating expenses led to excess reserves. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation:Depending on the business requirements, we recommend PEHP:1. Reduce excess working capital reserves, or2. Obtain a waiver from the federal cost negotiator allowing an increase in the number of days of working capital allowed to comply with federal guidelines.PEHP?s Response:Long-term DisabilityPEHP operates as a fully functioning third party-administrator for Long-term Disability benefits for the state of Utah and other public entities in Utah. Consequently, the reserves that PEHP holds and administers for the state of Utah do not relate to the payment of premium but the payment of ongoing, multi-year benefits for plan participants. These are vested benefits that PEHP would be required to pay on behalf the state for plan recipients, even if the program was discontinued and premiums were no longer collected. Because of this, PEHP will return excess premiums identified by our outside actuary while also seeking to obtain a waiver from the federal cost negotiator during 2023 to allow an increase in the number of days of working capital in compliance with federal guidelines.Medicare SupplementPEHP operates as a fully functioning third party-administrator for Medicare Supplement and Part D benefits for the state of Utah and other public entities in Utah. Consequently, the reserves that PEHP holds and administers for the state of Utah do not relate to the payment of premium but the payment of ongoing benefits for plan participants. During 2023, PEHP will seek to obtain a waiver from the federal cost negotiator to allow an increase in the number of days of working capital in compliance with federal guidelines on three grounds. First, the volatile nature of Part D pharmacy claims. Second, the relatively small dollar amount associated with Medicare premiums that can create a higher level of potential volatility. Third, the relatively small number of members covered by PEHP?s Medicare products that can also create a higher level of potential volatility.

LIHEAP CARES Act and Supplemental Payments Did Not Align with Policy and Award Terms (Department of Workforce Services) Federal Agency: Department of Health and Human Services ALN Numbers & Titles: 93.568 Low-Income Home Energy Assistance Program Federal Award Numbers: 2001UTLIEA, 2001UTE5C3 Questioned Costs: $1,080,846 (2001UTLIEA) and $1,461,846 (2001UTE5C3 ? CARES Act) Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2020-009 During fiscal year 2020, DWS developed a Coronavirus Aid, Relief, and Economic Security Act (CARES Act) benefit policy to rapidly issue flat benefit amounts of $550 per household for its Low-Income Home Energy Assistance Program (LIHEAP). This policy did not align with normal LIHEAP award terms and conditions, which did apply to the CARES Act portion of funding. This policy was carried forward into fiscal year 2021. The CARES Act LIHEAP Notice of Award did not modify the normal terms and conditions applicable to LIHEAP recipients and their eligibility requirements. DWS awarded the additional benefit on a first-come, first-served basis to households that already received benefits without determining any targeted income, energy assistance, or Coronavirus need. Normal terms and conditions for eligibility specify that benefit amounts should be determined by calculating income, energy burden, and target group, including for crisis-type payments. We reviewed a listing of all benefits paid with CARES Act funding and concluded that all payments during fiscal year 2021 totaling $1,461,404 were distributed according to the aforementioned policy. We also noted one instance where the household received $700 instead of the $550 outlined in the policy. Therefore, we question $1,461,404 as we consider the material portion of these CARES Act benefit payments excessive. In an effort to quickly disburse the CARES Act funds, program managers overlooked the purpose and timing outlined in the terms and conditions of its federal award and disregarded normal eligibility policies and procedures. As mentioned in our prior year report, division management?s inadequate oversight of policy development and rapid deployment could not only result in waste of federal funds, but also may cause targeted households to not receive adequate benefits. Because DWS received more CARES Act payment requests than CARES Act funding available, the Department paid $1,080,846 of regular LIHEAP supplemental benefits to cover these additional requests. These supplemental payments followed the same policy DWS used to distribute the CARES funding by making $550 flat benefit payments to households that had already received benefit payments rather than basing the payments on need as outlined in DWS policy. LIHEAP guidelines state that grantees must administer their LIHEAP programs according to their approved plan and in conformity with their own implemented rules and policies. The DWS policy states that ?[LIHEAP] program benefits are limited to a one-time payment per household, per program year.? If supplemental payments are paid to a household, those payments are created ?to correct the amount of a [LIHEAP] benefit paid or to reprocess a rejected [LIHEAP] benefit payment.? Further, the Federally approved State plan states that DWS will distribute funds in a way that ?the higher the energy burden, the higher the benefit for the household.? For the supplemental payments made with LIHEAP funding, noncompliance with existing DWS LIHEAP policies was the result of program managers misinterpreting Federal guidance. Federal guidance does allow supplemental payments. However, supplemental payments must still be paid in conformity with DWS?s implementing rules and policies. As noted above, DWS policy did not justify the type of supplemental payments made. Not following established policy could result in the waste of federal funds by providing unnecessary benefits. Recommendation: We recommend DWS: ? follow terms and conditions provided in Federal notices of awards, and provide adequate oversight of program policy development and deployment to ensure program rules are met, and ? disburse LIHEAP supplemental benefit payments in conformance with established rules and policies. DWS?s Response: We agree that amending the State Plan and HEAT Program Policy to specifically allow for flat supplemental benefit payments ensures that the policy decision has been properly approved.

Errors and Untimely Submissions for FFATA Reporting in TANF and LIHEAP Programs (Department of Workforce Services) Federal Agency: Department of Health and Human Services ALN Numbers & Titles: 93.558 Temporary Assistance for Needy Families; 93.568 Low-Income Home Energy Assistance Program Federal Award Numbers: 1901 UTTANF; 2101UTLIEA Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DWS did not have a control implemented to ensure timely and accurate Federal Funding Accountability and Transparency Act (FFATA) reporting. As a result, we identified the following errors in our sample of three TANF subawards and two LIHEAP subawards: ? one TANF subaward was not reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS); ? the subaward obligation/action date for all reported subawards was inaccurately reported in FSRS; and ? all subawards were not reported timely in FSRS. These errors and the associated dollar amounts are summarized as follows: TANF (See Schedule of Findings and Questioned Costs for table) LIHEAP 2 CFR 200.303 states ?the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? 2 CFR 170 states that DWS ?must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity.? The regulation further states that subaward information should be reported ?no later than the end of the month following the month in which the obligation was made.? First-tier subrecipients and subawards should be reported and submitted on FSRS in a timely manner. Although DWS had designed an internal control over FFATA reporting, the control was not implemented because the COVID-19 pandemic delayed training for newly hired personnel to assist with the internal control. Failure to properly implement internal controls over reporting can lead to inaccurate reporting and noncompliance with Federal regulations. Recommendation: We recommend DWS implement internal controls to ensure accurate and timely FFATA reporting. DWS?s Response: We agree with the finding.

Internal Review Did Not Detect Errors in TANF ACF-209 Reports (Department of Workforce Services) Federal Agency: Department of Health and Human Services ALN Numbers & Titles: 93.558 Temporary Assistance for Needy Families Federal Award Numbers: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DWS?s internal review did not detect the following errors in the 2 ACF-209 reports. We reviewed: ? The average number of hours reported for three of the 40 items selected were incorrect on the ACF-209 Q1 report. ? The reported work participation line was incorrect for two of the 40 items selected on the ACF-209 Q1 report (one of which is also the same case as one of the three items previously mentioned). ? The work participation line and corresponding average hours line was incorrect for one of the 20 cases selected on the ACF-209 Q3 report. This error occurred due to the case worker being able to edit information that was not supposed to be an editable field. 2 CFR 200.303 states, ?The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award.? Internal controls should provide reasonable assurance that reports, especially key line items, are complete and accurate. Due to an oversight, the review of both reports we selected for testwork failed to catch the errors mentioned above. Failure to adhere to internal controls could result in incomplete, inaccurate, and inconsistent reporting. Recommendation: We recommend that DWS ensure internal controls function as designed and that case workers are only permitted to edit appropriate fields. DWS?s Response: We agree with the finding. Two of the items identified in ACF-209 Q1 testwork were previously identified by the department as a report coding issue. The issue was corrected as of June 15, 2021. Additional checks and training will be implemented to correct the issues.

Leave and Fringe Benefits Charged to Disproportionately to Federal Activities (Department of Human Services) Federal Agency: Department of Human Services Assistance Listing Number and Title: 93.667 Social Services Block Grant Federal Award Number: 2001UTSOSR Questioned Costs: $8,406 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A For one of 60 Social Services Block Grant (SSBG) payroll charges reviewed, the Department of Human Services (DHS) inequitably charged an employee?s leave and associated fringe benefits between various activities. The employee?s leave, totaling $8,406, was charged to SSBG, whereas their regular pay was charged to a non-federal activity. Therefore, we question these costs. 2 CFR 200.431 and 200.405 indicate that costs should be equitably allocated to all related activities, including Federal awards. An incorrect default activity code for the employee?s leave in the payroll system caused this error. Without proper controls, unallowable costs could be charged to a Federal program and not be detected and corrected. Recommendation: We recommend DHS ensure leave and fringe benefits are appropriately coded in the payroll system to ensure equitable allocation of activities, perform a retroactive review and reallocation between federal and non-federal activities for such benefits, or work with Finance to develop a procedural or payroll system modification to address equitable allocation based on hours charged. DHS?s Response: We agree there should be better payroll coding care. We disagree this finding is a significant internal control deficiency to SSBG resulting in a questioned cost. The identified costs were not charged to the grant, the applicable Division did not receive SSBG for the 2021 State fiscal year. Flexibility for this grant exists with additional allowable costs not charged to the grant.

Subawards for SSBG & MHBG Not Included in FFATA Reports (Department of Human Services) Federal Agency: Department of Human Services Assistance Listing Number and Title: 93.667 Social Services Block Grant 93.958 Block Grants for Community Mental Health Services Federal Award Number: 2001UTSOSR; 21B1UTCMHS Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DHS did not have adequate controls implemented to ensure timely and accurate Federal Funding Accountability and Transparency Act (FFATA) reporting. As a result, we identified the following errors: ? Two of the four SSBG sub-awards tested were not reported in the FFATA Subaward Reporting System (FSRS); ? None of the 14 Block Grants for Community Mental Health Services (MHBG) subawards were reported in FSRS. DHS was unaware of the FFATA reporting requirement for MHBG and the FSRS did not have the MHBG awards listed to report. These errors and the associated dollar amounts are summarized as follows: SSBG (See Schedule of Findings and Questioned Costs for table) 2 CFR 200.303 requires that ?the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? 2 CFR 170 states that DHS ?must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity.? The regulation further states that subaward information should be reported ?no later than the end of the month following the month in which the obligation was made.? Failure to properly implement internal controls over reporting can lead to inaccurate reporting and noncompliance with Federal regulations. Recommendation: We recommend DHS improve internal controls to ensure accurate and timely FFATA reporting. DHS?s Response: We agree there should be better care for proper FFATA reporting. MHBG has not been made available by the federal government to report FFATA information.

Incorrect Benefit Rate Calculation and Personnel Charges to PRF Program (University of Utah) Federal Agency: HRSA (Health Resources and Services Administration) Assistance Listing Number and Title: 93.498 Provider Relief Fund Federal Award Number: Various Questioned Costs: $2,741,379 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The University of Utah Hospital and Clinics (UUHC) improperly charged a total of $2,741,379 for salaries, wages, and benefit costs to the Provider Relief Fund (PRF) program, which we question. Of this total, $1,649,913 was due to UUHC improperly applying a benefit rate to salaries and wages that already included the benefits in the total, thus double counting the benefits for these personnel costs. UUHC also incorrectly calculated the benefit rate applied to salaries and wages, causing $1,091,466 to be improperly charged to the PRF program. UUHC does not have independent reviews and approvals (internal controls) over certain payroll costs charged to the PRF program (e.g., information technology and pharmacy employees) and benefit cost rate calculations that prevent or detect and correct errors. Federal regulations (2 CFR 200.303) require non-federal entities to ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with?terms and conditions of the federal award.? UUHC did not fully understand the Federal requirements regarding internal controls. The charges to the PRF program must be actual expenses that are necessary and reasonable to prevent, prepare for, or respond to COVID-19 during the reporting period. Without adequate internal controls, inappropriate charges to the PRF program could be made and not prevented or detected and corrected. Recommendation: We recommend that UUHC implement and strengthen internal controls, such as independent review, over all charges to the PRF to ensure compliance with Federal requirements. University?s Response: We concur with the finding.

Overstatement of Expenditures in the PRF Report (University of Utah) Federal Agency: HRSA (Health Resources and Services Administration) Assistance Listing Number and Title: 93.498 Provider Relief Fund Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The University of Utah Hospital and Clinics (UUHC) inappropriately reported $1,066,070 for benefit costs that exceeded the actual benefit costs in the PRF Report for payments received in Period 1 (April 10, 2020 to June 30, 2020). This overstatement occurred because the spreadsheet used to prepare the report and the labor summary did not agree. UUHC does not have independent reviews and approvals (internal controls) over the PRF Report that prevents or detects and corrects errors. Federal regulations (2 CFR 200.303) require non-federal entities to ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with?terms and conditions of the federal award.? The amounts reported on the PRF Report should be based on actual expenses that are necessary and reasonable to prevent, prepare for, or respond to COVID-19 during the reporting period. The PRF Report is also used as the basis for the amounts reported in the statewide Schedule of Expenditures of Federal Awards (SEFA). Without adequate internal controls, the amounts reported in the PRF Report and statewide SEFA could be misstated. Recommendation: We recommend that UUHC implement and strengthen internal controls, such as independent review, to ensure accuracy of UUHC?s PRF activity in the PRF Report and the statewide SEFA. University?s Response: We concur with the finding.

Transactions Charged Twice to PRF Program (University of Utah) Federal Agency: HRSA (Health Resources and Services Administration) Assistance Listing Number and Title: 93.498 Provider Relief Fund Federal Award Number: Various Questioned Costs: $1,484 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The University of Utah Hospital and Clinics (UUHC) charged two transactions totaling $1,484 twice to the Provider Relief Fund (PRF) program. This duplication error occurred when the transactions were separately submitted and also included in a journal entry for reimbursement from the program. UUHC?s review of the submitted expenses (internal control) did not prevent or detect and correct these two transactions from being charged twice to the PRF program. According to 2 CFR part 200, subpart E, costs must ?be necessary and reasonable for the performance of the Federal award? and should not be charged multiple times, which overstates the actual expenses of the program. Therefore, we questioned these costs totaling $1,484. Recommendation: We recommended that UUHC strengthen the review of expenditure transactions (internal controls) charged to the PRF to ensure all transactions are necessary and reasonable to the program and not duplicated. University?s Response: We concur with the finding.

Absence of Monitoring Federal Funding Accountability and Transparency Act (FFATA) Reporting Resulted in Noncompliance (Department of Public Safety) Federal Agency: Department of Homeland Security Assistance Listing Number and Title: 97.036 Disaster Grants ? Public Assistance Federal Award Number: Various Questioned Costs: N/A Pass-through Entity: Department of Public Safety Prior Year Single Audit Report Finding Number: N/A The Department of Public Safety (DPS) does not monitor or perform an independent review over FFATA reporting to ensure complete, accurate, and timely reporting to the FFATA Subaward Reporting System (FSRS). This resulted in noncompliance as FFATA reports were not submitted to FSRS as required by 2 CFR 170. 2 CFR 200.303 requires non-federal entities to ?establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with ... the terms and conditions of the Federal award.? The absence of monitoring and independent review was due to staff turnover and technical issues regarding the reporting website that have yet to be resolved. It may further result in incomplete, inaccurate, and untimely reporting. Recommendation: We recommend DPS establish a monitoring process or independent review to ensure FFATA reporting is complete, accurate, and timely in accordance with the applicable compliance requirements. DPS?s Response & Corrective Action Plan: DPS/DEM plans to produce and implement an admin plan for federal awards to encompass all federal awards managed by the division. This plan will include an SOP for FFATA review and reporting. The Finance Manager will register for the FFATA submissions website and be responsible for submitting FFATA information as outlined in the upcoming Admin Plan. By implementing an SOP within our admin plan, we will ensure a control is in place and that the process for monitoring and meeting the requirement is clearly identified in perpetuity.

HOME Subrecipient Monitoring Requirements Not Performed (Department of Workforce Services) Federal Agency: Department of Housing and Urban Development ALN Numbers & Titles: 14.239 HOME Investment Partnerships Program Federal Award Numbers: M20-SG-490100 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2020-015 DWS did not adequately monitor any HOME (Home Investment Partnership Program) sub-recipients for fiscal year 2021. We selected three subrecipients for testwork and no monitoring occurred during the fiscal year for these three subrecipients. According to 2 CFR 200.332, a pass-through entity must evaluate each sub-recipient?s risk of noncompliance for regular monitoring, and perform monitoring activities to ensure the award is used for authorized purposes. The required monitoring did not occur due to personnel changes, the development of new internal controls, and timing issues. Failure to monitor sub-recipients could lead to noncompliance for DWS and its sub-recipients, as well as improper recording and reporting of federal expenditures. Recommendation: We recommend DWS design and implement effective internal controls for sub-recipient compliance requirements, with division management oversight. DWS?s Response: We agree with the finding.

HOME Eligibility Determinations and Housing Quality Inspections Not Performed (Department of Workforce Services) Federal Agency: Department of Housing and Urban Development ALN Numbers & Titles: 14.239 Home Investment Partnerships Program Federal Award Numbers: M20-SG490100 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2020-017 DWS did not have controls in place for single-family eligibility determinations during fiscal year 2021, and did not have controls over multi-family housing inspections from July 2020-November 2020 due to DWS not monitoring the implementation and effectiveness of internal controls after staff turnover. As a result, six of the 12 sampled projects tested were not subject to a control. Controls over multi-family inspections were implemented at the end of November 2020, and controls over single-family eligibility determinations were set to be implemented at the end of June 2021. 2 CFR 300.303 requires non-federal entities to ?establish and maintain effective internal control ? that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with ? terms and conditions of the federal award.? A lack of internal controls over single family eligibility determinations and multi-family on-site inspections increases the risk that ineligible recipients receive federally subsidized housing, eligible recipients have poor housing conditions, or that housing owners or management are noncompliant with federal housing subsidies. Recommendation: We recommend DWS design and implement policies and procedures to ensure controls over eligibility determinations and inspections are not neglected when staff turnover occurs. DWS?s Response: We agree with the finding.

Missing Documentation for Emergency Rental Assistance Payments (Department of Workforce Services) Federal Agency: Department of the Treasury ALN Numbers & Titles: 21.023 Emergency Rental Assistance Program Federal Award Numbers: N/A Questioned Costs: $1,000 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A One of the five Emergency Rental Assistance (ERA) Program applications reviewed by DWS did not identify and correct errors in the application (a control error rate of 20%). Five of the 40 sampled payments (a compliance error rate of 12.5%) for the Emergency Rental Assistance Programs (ERA) did not have documentation supporting the payment or had ineligible costs associated with the recipient. Specifically, ? An application did not include a management signed lease, ? Two applications did not contain required documentation to verify that household income was below 80% of Area Median Income (AMI), ? Two applications did not include signed Tenant Applications, ? An application was missing a utility bill and had the incorrect recipient listed on another utility bill. This application was also reviewed by the DWS quality control team, which did not detect the error, and ? One recipient received prospective rent for one additional month past the three month prospective rent maximum. The above errors did not meet the documentation and eligibility criteria established by section 501 of Division N of the Consolidated Appropriations Act, 2021, Pub. L. No. 116-260 (Dec. 27, 2020). These errors occurred because the eligibility workers did not follow all of the DWS ERA Procedures and the DWS quality control for reviewing 10% of the applications did not identify and correct the errors. This resulted in errors of $11,962 of our $62,710 in payments sampled. Subsequent to our testwork, DWS uploaded the required documentation to the system so we will not question the costs associated with the applications missing documentation. However, we have questioned the ineligible prospective rental payment of $1,000 as described above. Recommendation: We recommend that eligibility workers obtain and upload required documentation prior to disbursing ERA payments. DWS?s Response: We agree with the finding.

GOPB?s Oversight of Federal Pandemic Programs Should Be Strengthened (Governor?s Office of Planning and Budget) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.019 Coronavirus Relief Fund; 21.027 Coronavirus State and Local Fiscal Recovery Fund Federal Award Number: N/A Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2020-030 The Governor?s Office of Planning and Budget (GOPB) did not have adequate federal program management experience to oversee certain federal pandemic programs within the State of Utah. During fiscal year 2021, the State expended approximately $786 million of $935 million of the Coronavirus Relief Fund (CRF) and $15 million of $1.4 billion of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF). As a result of its federal grant management inexperience at the time, GOPB?s internal controls over compliance for both programs were insufficient. 2 CFR 200.303(a) states that all federal program recipients must establish and maintain effective internal controls to effectively manage its federal program. Elements of a sound internal control system (e.g., adequate knowledge or experience of key managers to discharge their responsibilities, adequate effective training, written policies and procedures, enforcement and accountability) were insufficient. For example, a. GOPB, which does not typically manage federal programs, was charged with quickly disbursing federal monies to state agencies and local governments, such as counties and cities; b. Guidance provided to state agencies was inconsistent or lacking in regard to the federal nature of funds and necessary federal compliance requirements; c. State agencies? use of required account coding for tracking expenditures was not consistently enforced; and d. Written policies and procedures outlining how GOPB?s staff would manage the programs did not exist, particularly with regard to its monitoring and enforcement of sub-recipient agreements and activity. A lack of effective controls over compliance with CRF and SLFRF federal regulations may result in unallowable items being charged to the programs. See Findings 2, 3, 4, 5, and 6 for further discussion. Recommendation: GOPB could continue to strengthen its federal program oversight by: 1. Gaining an understanding of federal ?Green Book? or ?COSO Framework? to design effective internal control, including the establishment of a sound control environment; 2. Utilize the resources, skills, knowledge, and experience within state agencies that typically manage large federal programs with similar significant or complex compliance requirements; 3. Ensure state agencies and recipients receive sufficient guidance and monitoring for accounting practices and federal program compliance; and 4. Establish written policies and procedures to support its monitoring and enforcement of accounting practices and federal program compliance. GOPB?s Response: The Governor?s Office of Planning and Budget (GOPB) agrees with this finding. As the COVID-19 pandemic escalated in March 2020 and Congress quickly enacted the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), Utah, along with other states, responded with urgency. Given the compressed timing of the enactment of the CARES Act, and the necessary timely distribution of aid, GOPB, then going by the name of the Governor?s Office of Management and Budget (GOMB), was not structured with a compliance framework to execute an unprecedented federal grant program of that magnitude. Where possible, GOMB delegated grant distribution and management to agencies with grant management experience, including the Department of Health. However, since the State of Utah was the prime recipient of Coronavirus Relief Funds (CRF) funds, GOMB was ultimately responsible for managing these funds. Given the scope period of this audit, ending in June 2021, we agree that GOMB did not have federal grant management experience at that time commensurate with the extraordinary responsibilities with which it was charged during that period in time.

State Coronavirus Relief Fund Monitoring Activities Not Occurring (Governor?s Office of Planning and Budget) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.019 Coronavirus Relief Fund Federal Award Number: N/A Questioned Costs: $16,998,600 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2020-031 The Governor?s Office of Planning and Budget (GOPB), the prime recipient for the Coronavirus Relief Fund, and state agencies did not adequately fulfill their subrecipient monitoring responsibilities for sub-recipient monitoring for approximately 635 agreements distributing nearly $264 million of pass-through funding during fiscal year 2021 (FY21) as follows: A. Communication of Key Federal Grant Information From a sample of 47 sub-recipient agreements, the following did not contain key federal grant information (i.e. sub-recipient DUNS number, ALN, pass-through entity, etc.), as required by 2 CRF 200.332(a). (See Schedule of Findings and Questioned Costs for table) B. Risk Evaluation & Monitoring Compliance From a sample of 47 sub-recipient agreements, the following were not sufficiently evaluated and monitored for compliance purposes according to 2 CFR 200.332 and respective agency policies and procedures. (See Schedule of Findings and Questioned Costs for table) GOPB did not communicate the federal nature of the funds appropriated by the legislature to the state agencies. State agencies, consequently, were either unaware of internal control and compliance requirements for CRF or failed to ensure their own internal controls functioned effectively to detect and correct errors. GOPB relied solely on the professional experience and expertise of agency management for internal controls and compliance. C. Use of Funds and Transparency Reporting ? Local Governments GOPB pass-through during FY21 approximated $202 million in cash advances to 220 local governments in the State. Each sub-award agreement was subject to key terms and conditions as to the 1) use of funds and 2) the reporting of expenditures. Since GOPB did not provide key grant information or perform evaluation and monitoring of the sub-awards, we reviewed the expenditures for a sample of 10 local government sub-awards that reported the highest amount of CRF spending through June 30, 2021. According to the sub-award agreement and in accordance with the Department of the Treasury?s guidance and FAQs: ?Permissible use of the funds may only be used to cover costs that [met] the following conditions: ? ?Are necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19); ? ?Were not accounted for in the recipient?s budget most recently approved as of March 27, 2020 (the date of enactment of the CARES Act) for the recipient; and, ? ?Were incurred during the period that [began] on March 1, 2020 and [ended] on December 30, 202[1] (as extended).? Of the 10 sampled local governments, the following seven did not have adequate documentation to support the ?necessary expenditure? (including cost-effectiveness determination for capital expenditures, as applicable) or that the cost was incurred within the period. Therefore, we question these costs. An audit was performed for Entity ?H? and included the related known question costs below. (See Schedule of Findings and Questioned Costs for table) While GOPB fulfilled its responsibility to quickly distribute funds, it did not consider itself a prime recipient responsible for ensuring or enforcing the local governments? compliance with CRF requirements under the sub-award agreements it established. It required quarterly expenditure reporting through the State?s financial transparency website. However, it did not monitor the expenditures reported for consistency or compliance with program requirements. This also affects the actual expenditure reporting for CRF Quarterly Financial Progress Reports?see Finding 4 for additional discussion. When GOPB and state agencies do not adequately communicate key federal program information, perform evaluation and monitoring procedures, and enforce sub-award agreement terms improper expenditure of federal funds may result without detection, inaccurate reporting of program activity, and potential repayment of federal funds. Recommendation: We recommend GOPB and other state agencies: 1. Communicate all required federal award information to sub-recipients; 2. Establish and/or follow effective written procedures for sub-recipient monitoring, where applicable; and, 3. Enforce key terms and conditions in agreements with local governments for compliance and reporting. GOPB?s Response: GOPB agrees with this finding. We agree that GOPB did not communicate all required federal award information to subrecipients during the period of this audit. This was largely due to the fact that when the Department of the Treasury disbursed CRF funds to Utah in April 2020, many elements of a typical federal grant award, including guidance on permitted use, the collection of DUNS numbers and other information about subrecipients, reporting requirements, and a Catalog of Federal Domestic Assistance number, were not made available. All information that was available at the time was communicated by GOMB to subrecipients in the ?State of Utah Coronavirus Relief Fund Local Government Allocation Agreement? (Agreement). GOPB believes nearly all costs that have been questioned will be determined to be eligible expenses if examined by the Department of the Treasury. When addressing necessary expenses, the CRF final rule expresses that the ?Department of the Treasury understands this term broadly to mean that the expenditure is reasonably necessary for its intended use in the reasonable judgment of the government officials responsible for spending Fund payments.? A limited number of the costs were questioned because they were related to activities that occurred prior to March 3, 2020. We believe most if not all of these amounts could be covered with other unreimbursed, eligible expenses occurring between to March 3, 2020 and December 31, 2021.

mproper Spending and Monitoring of Coronavirus Relief Fund Activity by GOPB and UETN (Governor?s Office of Planning and Budget) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.019 Coronavirus Relief Fund Federal Award Number: N/A Questioned Costs: $676,604 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A As the prime recipient for the State of Utah, the Governor?s Office of Planning and Budget (GOPB) did not ensure the State?s Coronavirus Relief Fund (CRF) was spent in accordance with the Department of the Treasury?s (Treasury) guidance and FAQs. In order to be allowed, Treasury?s guidance specifies payments from the CRF must be 1) necessary expenditures incurred due to the Coronavirus 2019 public health emergency, 2) costs that were not accounted for in the government?s most recently approved budget as of March 27, 2020, and 3) costs that were incurred during the period that began on March 1, 2020 and ended on December 31, 2021. We identified $585.2 million of fiscal year 2021 state agency expenditures, which we tested for internal controls and compliance with the guidance above. Our population included expenditures from the Utah Education and Telehealth Network (UETN), a state agency whose expenditures were based on a $125 million legislative appropriation from the CRF. From our expenditure sampling of $31.2 million, we identified five of 33 internal control errors (a 15.15 percent error rate). We have questioned the costs of $676,604 for the following expenditures: a. Two transactions for capital equipment totaling $107,666. These transactions do not appear necessary due to the Coronavirus Pandemic, and UETN was unable to provide documentation as to the cost-effect acquisition of the equipment as required by Treasury FAQs. One transaction for $86,674 was a portion of the replacement of a public television broadcast transmitter and one transaction for $20,992 for a hard drive shredder. b. Three transactions for software subscription services totaling $716,186. Two transactions appear to be necessary in response to the virus; however, the contracted period for services extended between one and four years beyond the December 31, 2021 covered period and does not appear to be reasonable based on Treasury?s definition of ?incurred? for services. The third transaction extended beyond the covered period and also did not appear necessary due to the Coronavirus Pandemic. We have questioned all of the third transaction of $19,577 and the portion of the other two transactions that extended beyond the covered period ($533,661), totaling $553,238. c. Two transactions for student program expenditures totaling $1,521. These transactions do not appear necessary due to the Coronavirus Pandemic. One transaction was for a $500 student scholarship with no documented Coronavirus response/need and another transaction was for $1,021 of university memorabilia for students. d. Two payroll transactions for non-public health and safety employees totaling $14,323. These employees? responsibilities did not meet the ?substantial dedication,? ?significantly different use,? or ?necessary expenditure? tests. UETN failed to properly document those considerations and charged 100 percent of the payroll costs to the CRF. Based on our understanding of necessary expenditures in response to the Coronavirus and UETN?s documentation, we have questioned $14,179 of the payroll costs. UETN does not typically receive and manage federal programs and was responsible to quickly use funds before anticipated period end dates or lose funding. UETN?s internal controls to ensure compliance were not adequately designed to prevent or detect and correct errors with compliance, documentation, etc. In addition, GOPB did not provide adequate oversight or monitoring of CRF funding appropriated to UETN on a cash advancement basis. Inexperience with federal program management combined with the pressures to ?use or lose? funding created an environment for federal funds to be used for purposes not allowed. Recommendation: We recommend that GOPB and UETN: a. improve its oversight and monitoring, especially of state agencies with less federal program experience, to ensure internal controls and compliance with federal funding; and, b. consider the use of cost-reimbursement method rather than extending cash advances. c. Utilize the resources, skills, knowledge, and experience within state agencies that typically manage large federal programs with similar significant or complex compliance requirements GOPB?s and UETN?s Response: GOPB agrees with this finding because there was insufficient documentation for the auditors to determine that CRF funding allocated to UETN was properly spent and monitored. Following the intent of the Legislature in Senate Bill 5001, Item 85, GOPB worked with the Division of Finance to transfer $125 million to UETN in four equal payments between July and October 2020. Before funding was transferred, UETN provided GOPB with a spend plan detailing how UETN would facilitate distance learning through training, technology, and broadband upgrades. While reviewing the spend plan, GOPB worked with UETN to ensure that the expenditures were reported on a regular basis. GOPB also worked with UETN to document that purchases were consistent with its ordinary course policies and procedures, including the period of performance for similar purchases in the past. Although GOPB did have oversight on how UETN used the funds, GOPB acknowledges that it did not have control over each expenditure. GOPB believes all costs that have been questioned will be found to be eligible expenses if examined by the Department of the Treasury. When addressing necessary expenses, the CRF final rule expresses that the ?Department of the Treasury understands this term broadly to mean that the expenditure is reasonably necessary for its intended use in the reasonable judgment of the government officials responsible for spending Fund payments.? GOPB and UETN believe that UETN followed the criteria established in the CRF guidance. While UETN may not have properly documented the reasons behind each expenditure questioned in this audit, GOPB believes that the expenditures made by UETN were within the ?reasonable judgment of the government officials responsible for spending Fund payments? in order to properly carry out the purpose of facilitating distance learning through technology and broadband upgrades.

Underlying Accounting Data Does Not Support Coronavirus Relief Fund Quarterly Reports (Governor?s Office of Planning and Budget) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.019 Coronavirus Relief Fund Federal Award Number: N/A Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The methodology used by the Governor?s Office of Planning and Budget (GOPB) to prepare and submit Coronavirus Relief Fund (CRF) quarterly financial reports did not ensure the complete and accurate reporting of expenditures as reflected in FINET, the State?s accounting system. We selected the December 2020 and April 2021 reports to test key line items and were unable to determine the completeness and accuracy of the line items, as follows: December 2020 Report ? Our reperformance of GOPB?s original query of FINET included $13.4 million more expenditures than its preparation schedules. ? Manual adjustments to prepare original data for reporting spanned $(141.7) million to $107 million, with a net reduction in expenditures of $62.9 million. April 2021 Report ? Our reperformance of GOPB?s original query of FINET included $4.4 million fewer expenditures than its preparation schedules. ? Manual adjustments to prepare original data for reporting totaled $208.6 million, including the exclusion of $137.6 million of original expenditures coded as Coronavirus Pandemic response and $71 million of other manual adjustments, potentially for FEMA reimbursement. ? 11 of 22 selected lines with obligation and expenditure detail could not be clearly traced to information in FINET or supporting documentation; unsupported amounts ranged from $(2.5) million to $18 million. ? Transfers expenditures should have reflected actual expenditures according to the Department of the Treasury?s (Treasury) reporting guidance; GOPB required reporting of actual expenditure data on a quarterly basis through the State?s financial transparency website. GOPB?s reported amount exceeded actual expenditure data available by at least $5.8 million, which would create unobligated CRF funds for the State. While manual adjustments, corrections, and other changes (i.e., FEMA reimbursements) are not unusual in reporting, we considered the following in relation to GOPB?s report preparation: ? Underlying accounting data and manual adjustments to prepare the reports have not been reconciled to the ?official record? of actual CRF expenditures in FINET since the submission of the reports. ? Underlying accounting data was inconsistently coded and tracked during fiscal years 2020 and 2021. Treasury?s guidance outlines that the ?prime recipient?s quarterly Financial Progress Report submissions should be supported by the data in the prime recipient?s accounting system.? Additionally, the Treasury Office of Inspector General (OIG) FAQs on reporting and record keeping describe the need to correct errors or modifications in a timely manner and to report actual obligations and expenditures rather than estimates. GOPB relied on state agencies to properly code expenditures as well as ensure proper use of funds. However, actual reimbursements, the ?official record,? drastically differed because of coding differences. Also, GOPB personnel did not prioritize the reconciliation of reported expenditures to the ?official record? of actual reimbursements because of other duties, time constraints, and priorities. Not properly coding and tracking expenditures, combined with untimely reconciliation, can lead GOPB to significantly misreport expenditures, misidentify errors, and miscalculate obligations. Recommendation: We recommend GOPB perform timely reconciliation of reported expenditures to actual reimbursements. GOPB?s Response: GOPB agrees with this finding because there was insufficient documentation for the auditors to verify reports. It is important to consider the context of the time in which many of these early CRF expenditures were made. The inconsistencies in coding is largely concentrated in the early expenditure of CRF funds (March to September 2020) as the state worked to respond to the unprecedented pandemic and coordinate its efforts across all state agencies. To the best of GOPB?s knowledge, all reported expenditures were complete, accurate, and eligible under the CARES Act CRF. Every CRF expenditure reported to the Department of the Treasury came from an expenditure recorded in FINET. However, GOPB acknowledges that because of complexities in coding and tracking during fiscal years 2020 and 2021, not all reported expenditures were reconciled to actual reimbursement in FINET before the end of the audit period. GOPB is in the process of compiling and reconciling a master CRF expenditure file. After the file is completed, GOPB is confident that every transaction reported to the Department of the Treasury can be backed up with FINET data. Due to FEMA reimbursements of CRF expenditures as well as other coding changes, GOPB fully expects that some transactions reported in previous reports to the Department of the Treasury will need to be adjusted. GOPB is working to identify these changes and will adjust reported expenditures accordingly so that the final report to the Department of the Treasury is reconciled to actual CRF reimbursements in FINET. This finding suggests that GOPB should have only reported funds that were transferred to a local government if the local government recipient had also expended the transferred funding. GOPB believes the Treasury?s guidance on reporting transfers to local governments remains ambiguous. Despite this ambiguity, GOPB believes it has accurately reported transfers greater than $50,000 in quarterly reports and also maintained other processes to track how much of the transfer funding was expended.

Inconsistent Policies and Controls Cause Awarding of Unallowable ARPA Business Catalyst Grants (Governor?s Office of Planning and Budget) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery Fund Federal Award Number: N/A Questioned Costs: $89,435 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The Governor?s Office of Economic Opportunity (Go Utah) incorrectly evaluated small businesses impacted by COVID-19 and subsequently disbursed small business catalyst grants to local recipients that did not qualify. We sampled 60 small business grant awards and identified five of 60 awards had evaluation errors (8.33 percent error rate). The sampled expenditures totaled $4,368,957 from a total population of $15,000,000. We have questioned costs of $89,435 as described below: a. For two awards, the evaluator incorrectly determined awards according to Go Utah?s targeted solvency criteria. The evaluation was based on the applicant?s submitted financial information that appeared inconsistent with solvency criteria. Therefore, we determined the businesses should not have received awards totaling $57,620, which we have questioned. b. For one award, the evaluator determined the award amount without proper documentation demonstrating negative financial impact as required by Go Utah?s policies. The small business, in the home construction industry, received a full grant award of $25,000, which we have questioned. c. For one award, the evaluator awarded a full grant to a personal fitness business that opened February 1, 2020. The applicant?s documentation demonstrated negative financial impact supported losses due to the business opening during the pandemic. We considered $6,815 of the full award to be excessive and have questioned that amount. d. For one award, the evaluator obtained the applicant?s W-9. However, the W-9 was not signed as required by Go Utah?s evaluation criteria. Go Utah subsequently obtained a signed W-9 to support the award to a valid business. The American Rescue Plan Act (ARPA) and Treasury?s Interim Final Rule allowed recipients to use funds to address economic harms incurred by small businesses due to the pandemic. Treasury?s Interim Final Rule also gives recipients latitude to establish criteria based on local economic conditions and business data. Go Utah established criteria, as described above, to determine the extent of allowable expenditures. 2 CFR part 200.303 also requires non-federal entities to ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with?terms and conditions of the federal award.? Go Utah, however, did not maintain effective internal control to detect and correct documentation errors and it did not develop, maintain or apply consistent policies and criteria. Ineffective controls and inconsistent policies can cause federal assistance to be awarded to invalid businesses or those not negatively impacted by the Coronavirus pandemic. Recommendation: We recommend Go Utah implement and apply clear and consistent program policies and design and implement effective internal controls to detect and correct deviations from those policies, including missing documentation. GOPB and Go Utah?s Response: GOPB and Go Utah accept this finding. GOPB and Go Utah believe that Go Utah made a good faith effort to implement policies, procedures, and controls while distributing small business catalyst grants to small businesses that were impacted by COVID-19. GOPB and Go Utah believe that if the Department of the Treasury examines the questioned costs that they will be found eligible. Go Utah, (formerly the Governor's Office of Economic Development), has a long history of overseeing compliance for business incentive programs. However, due to the findings of this audit and the fact that most of these previous compliance efforts were related to non-federal programs we accept the findings.

Go Utah Did Not Verify Suspension and Debarment for Small Business Grants (Governor?s Office of Planning and Budget) Federal Agency: Department of the Treasury Assistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery Fund Federal Award Number: N/A Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The Governor's Office of Economic Opportunity (Go Utah) did not establish internal controls to ensure compliance with federal suspension and debarment requirements for its small business catalyst grants. Department of Treasury?s Interim Final Rule issued May 17, 2021 states that ?payments from the ? Funds?will be subject to the provisions of the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR part 200),? which includes suspension and debarment requirements (see 2 CFR 200.214). 2 CFR part 200.303 also requires non-federal entities to ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with?terms and conditions of the federal award.? Go Utah was unaware that suspension and debarment requirements were applicable to its program and GOPB did not sufficiently communicate applicable federal program requirements. Failure to establish controls and appropriately review each grantee for suspension and debarment could result in federally debarred entities receiving grant awards. Recommendation: We recommend Go Utah gain an understanding of the suspension and debarment requirements and establish internal controls to ensure compliance with these requirements. We recommend GOPB ensure state agencies receive sufficient guidance and monitoring for federal program compliance. GOPB?s and Go Utah?s Response: GOPB and Go Utah agree with this finding. Prior to the release of these audit findings, Go Utah checked all small business catalyst grant recipients against the suspension and debarment list. Based on that search none of the small businesses are suspended or disbarred.

Indirect Cost Transfer Report Not Reviewed (Department of Environmental Quality) Federal Agency: Environmental Protection Agency Assistance Listing Number and Title: 66.605 Performance Partnership Grant Federal Award Number: 99847516 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The indirect cost transfer report review did not have the appropriate documentation to support a proper review. As such there is no evidence the actual report was even reviewed. 2 CFR 200.303 require non-federal entities to ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with?terms and conditions of the federal award.? Documentation that did not support the transfer report was incorrectly attached to the report when provided to the supervisor for review. The supervisor did not notice that the documentation did not support the report. The proper documentation supporting the cost allocations should be included with the entry. With no evidence the correct report and underlying documentation was reviewed, reasonable assurance could not be obtained that the approval to determine the report was in compliance with the terms and conditions of the award. Recommendation: We recommend: 1) Proper documentation supporting a report be provided to an approver; and, 2) Indirect cost allocations be approved only when the correct supporting documentation is provided. DEQ?s Response: We agree that the incorrect supporting documentation was attached to the FINET transaction for an indirect cost transaction.

Improper Treatment and Allocation of Direct Costs (Department of Environmental Quality) Federal Agency: Environmental Protection Agency Assistance Listing Number and Title: 66.605 Performance Partnership Grant Federal Award Number: 99847516 Questioned Costs: $32,888 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DEQ allocates direct costs that benefit multiple federal programs (e.g., employee leave) by identifying these costs, calculating an allocation to the respective federal programs, and then recording an adjustment on the general ledger. A person independent of this process does not review the calculation for correct treatment and allocation of said direct costs. As a result, $32,888 in utility costs were directly charged to the PPG grant when they should have been allocated among grants. We have questioned these costs for the PPG grant. 2 CFR 200.303 requires non-federal entities to ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with?terms and conditions of the federal award.? Staff preparing the calculation did not fully understand how to identify and treat utility costs in the calculation. Errors in and a lack of reviewing the calculation could result in overcharging a federal program for costs not directly attributed to the program. Recommendation: We recommend that DEQ strengthen their understanding of costs and cost principles and implement a control over such allocations. DEQ?s Response: We do understand costs and cost principals; however, we agree that some utility costs for our air monitoring stations were not properly allocated to all benefiting programs. For any cost that was not properly charged to the PPG, there are other eligible costs that could replace them. We also agree that we did not have an independent review of some of our other cost allocation transactions.

Working Capital Reserves in Excess of Federal Guidelines (Department of Government Operations) Federal Agency: Various Assistance Listing Number and Title: Various Federal Award Number: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2020-036; 2019-023; 2018-033; 2017-021; 2016-037; 2015-048; 2014-040; 2013-049; 2012 12-51; 2011 11-56 As of June 30, 2021, three divisions within the Department of Government Operations held working capital reserves in excess of federal guidelines as follows:(See Schedule of Findings and Questioned Costs for table) 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes in each internal service fund. The excess reserves were due to the inherent difficulty of accurately estimating expenses when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend that each division within DGO reduce excess working capital reserves within each of the respective funds or obtain a waiver from the federal cost negotiator allowing for an increase in the number of days of working capital allowed to comply with federal guidelines. DGO?s Response: Annually, the Department of Government Operations (Department) analyzes reserves and estimated costs to determine a rate that reduces and minimizes excess reserves. However, these rates are determined and legislatively approved months in advance of the rate being applied and cannot be changed until the next annual rate setting cycle. Due to these timing differences, rates applied may not reflect new and unforeseen circumstances, resulting in excess or insufficient reserves. The Department makes every effort to adjust future rates to reflect changing circumstances and to minimize potential excess reserves.

Working Capital Reserves in Excess of Federal Guidelines (Public Employees Health Plan) Federal Agency: Various Assistance Listing Number and Title: Various Federal Award Number: Various Questioned Costs: Undeterminable Pass-through Entity: None Prior Year Single Audit Report Finding Number: 2020-039; 2019-026; 2018-036; 2017-023; 2016-039; 2015-050; 2014-042; 2013-050; 2012 12-53; 2011 11-58; As of June 30, 2021, the Public Employees Health Program (PEHP) held working capital reserves in excess of federal guidelines as follows below. (See Schedule of Findings and Questioned Costs for table) 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes. The excess reserves were due to the inherent difficulty of accurately estimating expenses. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend that PEHP reduce excess working capital reserves or obtain a waiver from the federal cost negotiator allowing an increase in the number of days of working capital allowed to comply with federal guidelines. PEHP?s Response: State Medical ? Claim costs in fiscal year 2021 increased and reduced the excess reserves in this program from $27 million at June 30, 2020, to $9 million at June 30, 2021. Claim costs increased due to increased medical procedures and COVID-19 claim costs. Medical claim cost trends are continuing to increase in fiscal year 2022 and excess reserves are lower as of September 30, 2021. Due to the unknown nature and risks associated with health care costs due to the COVID-19 pandemic, PEHP would like to extend the timeframe to study medical claim cost trends. PEHP will request Cost Allocation Services (CAS) to allow more time to study claims and health care cost trends related to COVID-19. If reserves in this program are still above federally allowed amounts as of June 30, 2024, PEHP will either issue a refund to employers and subscribers or refund the federal portion. State Dental ? Due to COVID-19, dental claim costs were well below expectations due to the guidance given from the CDC regarding delaying elective procedures, surgeries, and non-urgent outpatient visits. Dental claim costs increased significantly in fiscal year 2021 and reduced the excess reserves in this program from $2.5 million at June 30, 2021 down to $336 thousand at June 30, 2021. Since the expected outlook is unclear as it relates to expected dental claims due to the delay of non-urgent care dental visits, PEHP will request CAS to allow additional time to study claims and dental costs trends related to COVID-19. If reserves in this program are still above federally allowed amounts as of June 30, 2022, PEHP will either issue a refund to employers and subscribers or refund the federal portion. Long-term Disability ? The COVID-19 pandemic may cause some of our insureds to become disabled and thus cause a large increase in claims and a severe reduction in the reserves of this program. Therefore, PEHP will request CAS to allow additional time to study claim and health care cost trends related to COVID-19. Excess reserves increased in fiscal year 2021 due to lower claim costs. If reserves still exist above the federally allowed amounts as of June 30, 2022, PEHP will either issue a rebate to subscribers or refund the federal portion. Medicare Supplement ?This program is for people age 65 and older and these insureds, due to their age and higher likelihood of having serious medical conditions, are at greater risk of becoming seriously ill and incurring large medical claims if they are infected with COVID-19. The federal subsidies increased in fiscal year 2021 which caused the excess reserves to increase. PEHP will request CAS to allow additional time to study Medicare supplement claims and health care cost trends related to COVID-19. If reserves still exist above the federally allowed amounts as of June 30, 2022, PEHP will either issue a rebate to subscribers or refund the federal portion.

SNAP Benefit Issuance Reconciliation Differences Go Unresolved(Department of Workforce Services)Federal Agencies: Department of Workforce ServicesCFDA Numbers and Titles: 10.551 and 10.561 Supplemental Nutrition Assistance ProgramFederal Award Numbers: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Numbers: N/ADWS did not identify or resolve ongoing reconciling differences between eREP, its central issuance system, and Conduent, its EBT contractor postings, in a timely manner. The reconciling differences began in January 2019, averaged $143,451 per day through June 30, 2020, and ranged from $8,451,857 to ($6,431,326). Because it had not resolved the differences, DWS could not rely on its system to generate issuance data for federal reporting purposes and instead, relied upon external issuance data provided by Conduent.7 CFR 274.4 requires State agencies to reconcile benefits posted on their central computer against benefits on issuance authorization files, to reconcile total funds entering into, exiting from, and remaining in the system each day, and to provide maintenance of audit trails that document the full cycle of benefit issuance through retailer settlement. In addition, the regulation requires benefit issuance and reconciliation information be reported from the State agency?s system to USDA Food and Nutrition Service.During its system update processes, DWS implemented changes in eREP that inadvertently caused the system to incorrectly report benefit issuance amounts for daily reconciliation purposes. Improperly implemented system updates could result in incorrect benefit calculations and issuances that remain undetected.Recommendation:We recommend DWS improve its internal controls over change management processes to ensure errors in application programs are prevented or detected and corrected before the changes are moved into the production environment.DWS?s Response:The department concurs with the finding.

Contract Addendum Noncompliant with Federal Procurement Regulations(Snow College)Federal Agency: Department of EducationCFDA Number and Title: 84.425F ? Higher Education Emergency ReliefFund (HEERF) - Institutional PortionFederal Award Number: P425F201257Questioned Costs: $23,167Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/ASnow College (the College) did not conduct a procurement in accordance with Federal regulations. In February 2020, prior to the outset of the COVID-19 pandemic (the pandemic), the College entered into a contract with an online program management provider (the OPM) to enhance its online education program. This contract was focused solely on non-campus based students. In May 2020, subsequent to the outset of the pandemic, the College entered into a contract modification with the OPM that replaced the original contract and effectively expanded the contract to assist the College in expanding its online education for traditional on-campus students. The contract modification significantly increased the price of the contract to an annual amount of $196,000. In addition, the College was not able to provide documentation to support allowability of costs charged to the program. Because the College does not spend much involving contracts subject to federal procurement requirements, management was unfamiliar with the related requirements on procurement and monitoring contracts for allowable activities and costs. As a result, the following control and compliance issues occurred:? The College did not have control procedures to ensure compliance:2 CFR 200.303 requires non-federal entities to ?establish and maintain effective internal control ? that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with ? terms and conditions of the federal award.? The College did not have the required control procedures to ensure compliance with federal requirements related to contracts.? The contract was noncompliant with grant guidance and contract services were not monitored:In relation to the use of OPMs, the United States Department of Education Higher Education Emergency Relief Fund Frequently Asked Questions (FAQ) Rollup Document, Question 40, stated that, ?institutions may use the funds for Recipient?s Institutional Costs to pay a per-student fee to a third-party service provider, including an OPM, for each additional student using the distance learning platform.? The College was unable to produce any documentation related to a per-student fee. In addition, the College was unable to produce sufficient documentation that the OPM provided the agreed upon services and to support the costs was for allowable activities and costs.? The College did not ensure the OPM was not suspended or debarred:2 CFR section 180.300 requires that ?when ? enter[ing] into a covered transaction ? you must verify that the person [or entity] with whom you intend to business is not excluded or disqualified.? The College?s standard procedure is to include a clause in contracts certifying that the vendor is not suspended or debarred. Neither the original contract nor the contract modification contained any such clause. The College did not perform any procedures to ensure the OPM was not suspended or debarred.? The College did not adequately document the procurement process:2 CFR 200.318(i) requires that ?the non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include ? rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price.?The contract extension used was a non-competitive procurement, or a sole-source award. While the use of a non-competitive procurement may have been justified based on the criteria in 2 CFR 200.320(f), the College could not produce documentation of its rationale for limiting competition, selection of contract type, or selection of the OPM.? The College did not perform the required cost or price analysis:2 CFR 200.324 requires that, ?the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications.? Although the contract modification was above the simplified acquisition threshold, the College did not perform any acceptable cost or price analysis.These control and compliance issues increase the risk that the College may incur costs that were not in compliance with allowable activities and costs, procurement, suspension and debarment requirements. We questioned the amount of $23,267 charged to the grant.Based on subsequent communication, the College anticipates having additional eligible expenditures that may be used to replace these questioned costs in the following year by the end of the grant period.Recommendation:We recommend the College familiarize itself with federal procurement requirements and establish effective control procedures to ensure compliance with federal procurement, allowable activities, and allowable costs requirements.College?s Response:Snow College agrees with this finding. At the time of the original procurement of the consultant, institutional funds had been established for the payment of these services. In response to the COVID-19 pandemic and in keeping with the original intent of the contract, an addendum was written that expanded services by the contractor. Since the services were expanded to include online delivery of Snow College courses directly related to the institution?s response to COVID-19, the addendum was determined to be paid through CARES Act relief funds. State procurement code was followed when the original contract was signed, but since Snow College had not originally intended to pay any portion of the contract in question from federal dollars, the federal procurement process was not followed. Snow College agrees with the finding and will ensure federal procurement code is followed when the institution plans to spend federal monies.

Reported Expenditures Not Supported by Underlying Reimbursement Requests(Utah State Board of Education)Federal Agency: Department of EducationCFDA Number and Title: 84.425C Governor?s Emergency Education Relief (GEER)84.425D Elementary and Secondary School Emergency Relief (ESSER)Federal Award Number: S425C200031S425D200032Questioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Utah State Board of Education (USBE) does not require local education agencies (LEAs) to submit reimbursement requests in a timely manner and reports estimated expenditures made during the fiscal year. The following table summarizes the differences between the reported expenditures and actual expenditures, or expenditures supported by reimbursement requests, through June 30, 2020. (See Schedule of Findings and Questioned Costs for chart/table" As a result, we were unable to test $4,036,433 of reported expenditures for compliance with allowable activities and allowable cost compliance requirements outlined in the Office of Management & Budget?s 2020 Compliance Supplement. Because USBE had not drawn down the $19,569,810 as of June 30, 2020, we did not question the unsupported expenditures. Timely reimbursement requests would more effectively help USBE detect and correct any potential noncompliance at the LEA level.Recommendation:We recommend USBE require the LEAs to submit reimbursement requests in a timely manner.USBE?s Response:The USBE agrees with this finding.

Medicaid Program Review Accuracy Rates 9 Points Below Target(Department of Health; Department of Workforce Services)Federal Agency: Department of Health and Human ServicesCFDA Number and Title: 93.778 Medical Assistance Program (Medicaid Title XIX)Federal Award Numbers: VariousQuestioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Department of Workforce Services (DWS) Program Review Team (PRT) process had an 88% accuracy rate, as compared to its 97% target accuracy rate, and payment errors of $45,249.99, as identified by the DOH Medicaid Eligibility Quality Control (MEQC) team during a recent review. The MEQC team reviewed 295 cases subject to a PRT review. In these 295 cases, the MEQC team identified 36 errors resulting in a 12% error rate (88% accuracy rate). While DWS counselors incorrectly determined applicants? initial eligibility, the PRT process did not identify or correct these errors. Examples of incorrect eligibility determinations included cases where:? An individual was approved for an incorrect medical program;? An individual was ineligible for the medical program issued; or,? Denial of the program was incorrect.The MEQC team also identified areas of concerns in the PRT process contributing to its inability to identify and correct errors, including: misapplication of Medicaid policies, inadequate documentation of review, incorrect level of review, improper correction of errors, inadequate procedures and guidance, and incorrect methods in calculation of the error rate. Because there is no federal requirement to return eligibility-based overpayments, we have not questioned any costs.The eligibility determination accuracy rate is used to determine the state?s Federal Medicaid Assistance Percentage (FMAP). Thus, if the State does not meet its target accuracy rates, the federal government could potentially reduce the FMAP rate. Even minimal reductions in the FMAP rate could lead to significant reductions in the federal dollars used to fund Medicaid in the State of Utah.Recommendation:We recommend that:1. DWS improves its PRT case review process to remedy the concerns identified above (e.g., misapplication of Medicaid policies and incorrect level of reviews) to meet the 97% target accuracy rate; and,2. DOH provides assistance to DWS as needed to improve the PRT process.DOH?s Response:The Utah Department of Health agrees with this finding.DWS? Response:The MEQC audit was completed in June 2019. The PRT case review guide was updated in September 2019. Program (policy) specialists will be attending the PRT meetings each quarter to review trends and go over policy clarifications and external audit findings. We also committed to publishing the PRT resources in the Operations Manual - including a consistency guide.The PRT managers meet on a regular basis with the Program managers to review and discuss policy and procedure. The meeting entails discussion on how QC would look at specifics and what potentially would be cited. They also engage in conversations about error trends, individual training needs, and program specific policy that may need to be clarified or retrained. This ensures consistency in what is being trained and what is being cited by PRT.Lastly, the PRT updated their procedures, to ensure clearer guidance.The PRT process is designed to measure employee performance and is not intended to replace the MEQC process.The Department of Health (DOH) has committed to working with DWS on improvement of the PRT process.

Use of Appropriate National Correct Coding Initiative (NCCI) Edit Files Not Verified(Department of Health)Federal Agency: Department of Health and Human ServicesCFDA Number and Title: 93.778 Medical Assistance Program (Medicaid Title XIX)Federal Award Numbers: VariousQuestioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Department of Health (DOH) did not verify its third-party contractor?s use of appropriate National Correct Coding Initiative (NCCI) edit files. According to the NCCI Medicaid Policy Manual and the NCCI Medicaid Technical Guidance Manual, DOH is required to use the most recent quarterly Medicaid NCCI edit files to ensure the proper payment of procedures. While DOH obtained from the federal government website the updated quarterly edit files and then sent the files to its third-party contractor, it did not independently verify the contractor?s use of the updated edit files. Rather, DOH felt that reviewing the weekly and quarterly reports delivered by the contractor provided adequate verification. Not verifying the use of the appropriate edit files may result in improper payments.Recommendation:We recommend DOH implement procedures to verify that the third-party contractor uses the most recent quarterly Medicaid NCCI edit files.DOH?s Response:The Utah Department of Health agrees with this finding.

LIHEAP CARES Act Benefit Policy Development and Deployment Did Not Align with Award Terms and Conditions(Department of Workforce Services)Federal Agencies: Department of Health and Human ServicesCFDA Numbers and Titles: 93.568 Low-Income Home Energy Assistance ProgramFederal Award Numbers: 2001UTE5C3Questioned Costs: $6,606Pass-through Entity: N/APrior Year Single Audit Report Finding Numbers: N/ADWS developed a Coronavirus Aid, Relief, and Economic Security Act (CARES Act) benefit policy to rapidly issue flat benefit amounts of $550 per household for its Low-Income Home Energy Assistance Program (LIHEAP). This policy did not align with normal LIHEAP award terms and conditions, which should be effective for the CARES Act portion of funding.The CARES Act LIHEAP Notice of Award did not modify the normal terms and conditions applicable to LIHEAP recipients and their eligibility requirements, but it did extend the period of obligation to September 30, 2021. DWS awarded the additional benefit on a first-come, first-served basis to households that already received benefits during the program season (October 2019 ? April 2020) without determining any targeted income, energy assistance, or Coronavirus need. Normal terms and conditions for eligibility specify that benefit amounts should be determined by calculating income, energy burden, and target group, including for crisis-type payments.We sampled 13 households and determined all 13 households were over the maximum benefit amount established under normal award terms and conditions. We calculated a sample excess benefits amount of $6,006 from a sample population of $7,150 and projected the error over the total CARES Act benefit population of $4,818,050. Based on our sampling, we consider the material portion of CARES Act benefits paid to be excessive. We have questioned the sample excess benefits of $6,006. In addition, we identified four households from our population that received $150 each in excess of the flat $550 CARES Act amount. Therefore, we have also questioned those costs of $600.In its effort to quickly disburse the CARES Act funds, program managers overlooked the purpose and timing outlined in the terms and conditions of its federal award and disregarded normal eligibility policies and procedures. In addition, division management?s inadequate oversight of policy development and rapid deployment could not only result in waste of federal funds, but also in targeted households not receiving adequate benefits.Recommendation:We recommend DWS program managers follow terms and conditions provided in federal notices of awards, and division management provide adequate oversight of program policy development and deployment to ensure it meets program purposes.DWS?s Response:When the CARES supplemental funding was awarded, states were given the flexibility to determine how to disperse the funding, including the option to provide a flat benefit amount. Due to system limitations, the department decided on a flat benefit amount in order to get the benefits to families quickly and efficiently. Other states also provided flat benefit amounts to LIHEAP customers including Nebraska, Washington D.C., and Colorado. All benefits went to LIHEAP-eligible households.

LIHEAP Benefit Overpayments Due to Improper Eligibility Decisions(Department of Workforce Services)Federal Agencies: Department of Health and Human ServicesCFDA Numbers and Titles: 93.568 Low-Income Home Energy Assistance ProgramFederal Award Numbers: 2001UTE5C3, G-1901UTLIEAQuestioned Costs: $170Pass-through Entity: N/APrior Year Single Audit Report Finding Numbers: N/ADWS and its sub-recipients improperly determined eligibility benefit amounts for LIHEAP. We sampled 60 households that received regular LIHEAP benefit payments and noted errors related to 2 of the 60 cases (3.33 percent error rate). The sampled expenditures totaled $31,932 from a total population of $15,167,806. We have questioned costs of $170 as described below:a. For one case, the intake worker did not include annuity income on the client?s application. This caused the client to receive a total benefit overpayment of $20, which we have questioned.b. For another case, the intake worker inaccurately identified the client as over 60 years old and disabled. This caused the client to receive a total benefit overpayment of $150, which we have questioned.DWS policies, as delegated by 42 USC 8624, specify that annuity income should be included in benefit calculations. Additionally, program policies identify disabled clients over age 60 as a target group for additional benefit. DWS?s sub-recipient monitoring activities did not adequately consider, assess, or address risks to compliance posed by sub-recipient employee turnover, policy training, and program requirement knowledge. Improper eligibility determinations and failure to detect errors can cause inappropriate benefit payments and improper use of federal funds.Recommendation:We recommend DWS focus its sub-recipient monitoring activities, including risk assessment and policy communication, to address eligibility noncompliance risks from sub-recipient staff turnover, training, and ineffective internal controls.DWS?s Response:The department will implement the recommendation.

LIHEAP Reporting Errors and Untimely Submissions(Department of Workforce Services)Federal Agencies: Department of Health and Human ServicesCFDA Numbers and Titles: 93.568 Low-Income Home Energy Assistance ProgramFederal Award Numbers: G-1901UTLIEA, 2001UTE5C3Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Numbers: N/AThe Department of Workforce Services did not have internal controls to prevent and detect the errors in and timely submission of its LIHEAP reports as follows:LIHEAP Performance Data Form? 12 of 61 lines reported incorrect information. The difference of reported average dollar amounts ranged from $43 understated to $3,869 overstated, and number of households reported ranged from 4,084 to 1,077 understated.? The report was submitted 4 days after the report due date.Annual Report on Households Assisted by LIHEAP? 3 of 23 lines reported incorrect information. Inaccurate number of households ranged from 41 understated to 2,000 overstated.? The report was submitted 42 days after the report due date.Carryover and Reallotment Report? This report was prepared and submitted before it was approved.2 CFR 200.303 states, ?The non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? Reports, especially key line items, should be prepared and documented from complete, accurate, and consistent data, subjected to internal review, and submitted in a timely manner as required by award terms and conditions.Program managers misunderstood new program requirements, used inconsistent data, and inadequately documented report preparation, which should be detected by internal controls. Program managers, however, relied on external review, rather than an internal review. In addition, division managers did not supervise program managers to ensure they understood program requirements or monitor internal controls for on-going performance, effects of new requirements, or maintenance of separation of duties. Failure to design, implement, and adhere to internal controls could result in incomplete, inaccurate, and inconsistent reporting.Recommendation:We recommend DWS:1. Design and implement internal controls for performance and special reports;2. Division managers perform supervision and monitoring activities to ensure internal controls function as designed;3. Gain a sufficient understanding of performance report requirements;4. Use consistent data for reporting and adequately document preparation methodology; and,5. Submit reports on time.DWS?s Response:The former HEAT Program eligibility system, SEALWorks, had limitations for reporting. On October 1, 2020, the HEAT Program began using the department?s Electronic Resource Eligibility Product (eREP) system for eligibility determination. The eREP system will enable the department to provide more accurate data for reporting and mitigate the need for manual data collection. An extension to the deadline was requested and granted by OCS for the report to be submitted at a later date as the data was still being gathered.

Inadequate Internal Controls over Preparation of Federal Reports(Southern Utah University)Federal Agency: DHHSCFDA Numbers and Titles: 93.600- Head StartFederal Award Numbers: VariousQuestioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThere was no accuracy review performed on the Real Property Status Report and the Federal Financial Reports required for University Head Start by the Department of Health and Human Services (DHHS). As a result, before the two required Federal Financial Reports we tested were sent to DHHS, Management did not detect and correct inaccurate indirect cost rates reported on both reports and the incorrect basis of accounting box checked on one report.Federal regulations (2 CFR 200.303) require non-federal entities to ?establish and maintain effective internal control?that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with?terms and conditions of the federal award.?Head Start did not establish internal controls over reporting because it relied on UniversityAccounting Services? experience and expertise to ensure the accuracy of reports. The errors we noted on the reports we reviewed occurred because of a misunderstanding by Accounting Services staff about what rate should be presented on these reports and because the staff preparing the report made typos.A lack of controls over the preparation of federal reports increases the risk that reports are not prepared accurately and in accordance with award reporting requirements, as illustrated by the errors found in the tested reports.Recommendation:We recommend the Head Start program design and implement an effective internal control to ensure the accuracy of its reports.University?s Response:We appreciate your recommendation. Southern Utah University felt it was sufficient control to have the financial reports prepared and submitted by accounting services, separate from the Head Start Program. New procedures will be implemented to add an additional level of approval.

Improper Reporting to Those Charged with Governance(Southern Utah University)Federal Agency: DHHSCFDA Numbers and Titles: 93.600- Head StartFederal Award Numbers: VariousQuestioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Head Start program does not regularly share monthly financial statements with the Board of Trustees. 42 USC 9837(d)(2)(A) states that Head Start agencies ?shall ensure the sharing of accurate and regular information for use by the governing body and the policy council, about program planning, policies, and Head Start agency operations, including monthly financial statements, including credit card expenditures?.?Rather than providing a monthly financial statement with the Board of Trustees, financial information is presented during University Head Start subcommittee meetings. However, the subcommittee does not meet regularly and only met once during fiscal year 2020. Because the Board of Trustees does not have access to regular financial information, including monthly financial statements, they are limited in their ability to fulfill their fiscal responsibility over the Head Start program.Recommendation:We recommend the Head Start program develop policies and procedures that require the regular sharing of financial information with the Board of Trustees.University?s Response:The SUU subcommittee to the Board of Trustees has been delegated by the trustees to represent them in all Head Start matters. The Trustees have appointed a member of the Board of Trustees to represent them on the subcommittee and then report directly back to the Board.

Untimely Identification and Resolution of HOME Loan Reconciliation Differences(Department of Administrative Services; Department of Workforce Services)Federal Agencies: Department of Housing & Urban Development (HUD)CFDA Numbers and Titles: 14.239 HOME Investment Partnership ProgramFederal Award Numbers: M19-SG490100Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Numbers: N/AFinance services Home Investment Partnership Program (HOME) loans on behalf of the Department of Workforce Services (DWS). Finance did not properly identify and resolve reconciling items between the State?s loan tracking system and general ledger (FINET) for the HOME loans. DWS did not adequately monitor Finance?s reconciliation to ensure differences were properly identified and resolved in a timely manner. Reconciling differences from the November 2019 and/or May 2020 reconciliations include the following:? 29 items which spanned from fiscal year 2009 to 2019 and totaled $1,169,228? 18 unusual items which included ?unknown differences? or amounts that did not appear to be HOME loan related and totaled $1,368,151? 1 unusual current fiscal year item left unresolved for a majority of the fiscal year in the amount of $745,000.Adequate internal controls over cash receipts, disbursements, and financial reporting rely upon the performance of monthly reconciliations between the loan system and the general ledger. This reconciliation procedure also ensures the correct use and reporting of the HOME loan principal and interest payments (program income). Reconciling differences should be investigated and resolved in a proper and timely manner.Finance?s focus on prioritizing current transactions rather than previous transactions combined with constraints of setting up loans in the loan system caused these errors to occur. Additionally, DWS, who is primarily responsible for compliance with HOME loan requirements, did not actively monitor loan servicing performed by Finance.DWS uses program income to award and disburse new HOME loan funds prior to drawing additional funds from federal sources. Failure to properly identify and resolve loan fund transactions in a timely manner can result in undetected errors, fraud, or noncompliance with federal program income requirements.Recommendation:We recommend the following:1. Finance and DWS work together to investigate and resolve the reconciling differences in a timely manner;2. Finance and DWS resolve loan system constraints to ensure accurate and proper recording and reporting of transactions; and3. DWS actively monitor loan servicing performed by Finance to ensure proper handling of HOME loan principal and interest payments (program income).DAS?s Response:We agree with the findings and recommendations outlined in your Management Letter.DWS?s Response:Prior to the audit, the department initiated and completed a comprehensive reconciliation of loan information for the HOME Investment Partnerships Program in the department?s grant management system (Webgrants), the State?s general ledger system (FINET), the State?s loan management system (CLCS), and the Integrated Disbursement and Information System (IDIS). This comprehensive reconciliation spanned a period of 15 years to ensure that department personnel captured and reconciled all historical differences. The State?s loan management system (CLCS) is administered by the State Division of Finance which also services the HOME Investment Partnerships Program loans for the department. The department has been working with the State Division of Finance to resolve the outstanding reconciling differences identified as a result of the comprehensive reconciliation. Resolving the reconciling items for the HOME Investment Partnerships Program is complex due to the use of multiple subaccounts for the program and a significant amount of activity between those subaccounts by both the State Division of Finance and the department. The majority of the unreconciled items noted by the auditor occurred in years prior to the employment of current State Division of Finance staff. Many items require extensive research to resolve due to the lack of evidence and documentation on old reconciliations. The net effect of the errors identified by the auditor totaled $569,262.

Failure to Comply with HOME Sub-Recipient Monitoring Requirements(Department of Workforce Services)Federal Agency: Department of Housing & Urban Development (HUD)CFDA Numbers and Titles: 14.239 HOME Investment Partnership ProgramFederal Award Numbers: M19-SG490100Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AAs part of our audit of the Home Investment Partnership Program (HOME) sub-recipient agreements at the DWS?s Housing and Community Division, we identified the following:? Program and financial managers failed to ensure a complete contractor/sub-recipient determination existed for six of eight agreements. For the remaining two agreements, both original determinations were incorrect or incomplete. The program and financial managers subsequently identified and completed one of these determinations nine months after execution, but the determination remained incorrect. Division management, the party charged with agreement execution, did not detect or correct any missing, incorrect, or incomplete determinations prior to executing agreements.? Program contracting processes failed to ensure all agreements included key pieces of information, such as the date of the federal award, the total amount of federal funds obligated to the entity (including the amount awarded by the current contract), and the indirect cost rate for the awards. Four of these eight agreements were missing the awardee?s unique entity identifier/DUNS.? Pre-award risk assessments were not performed by Internal Audit because of the improper determination of subrecipients.? Program managers did not have effective internal controls to ensure proper identification, communication, and monitoring activities were performed for HOME sub-recipients.2 CFR 200.331 indicates ?A pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor.? Additionally, 2 CFR 200.332 sets forth requirements that a pass-through entity must clearly identify certain federal award information in its subawards, evaluate each sub-recipient?s risk of noncompliance for regular monitoring, and perform monitoring activities to ensure the award is used for authorized purposes. Lastly, 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal control over federal awards to provide reasonable assurance it manages its federal awards in compliance with federal requirements.Program and financial managers did not follow or consider DWS?s updated sub-recipient policies (dated July 1, 2018) to ensure compliance with Uniform Guidance. Division managers did not ensure adherence to policies or monitor internal controls for design, implementation, and on-going performance to effectively ensure compliance. Additionally, these errors occurred due to lack of clear understanding of sub-recipient determinations and monitoring requirements using HOME-program specific guidelines (24 CFR 92.504), blurred determination and decision review responsibilities, and siloed contracting procedures.Misidentification of sub-recipients, incomplete or missing sub-award information, and failure to monitor sub-recipients could lead to noncompliance for DWS and its sub-recipients, as well as improper recording and reporting of federal expenditures.Recommendation:We recommend the following:1. Program and financial managers gain an understanding of and document sub-recipient policies to comply with Uniform Guidance, HOME federal regulations (24 CFR 92.504), and DWS policies;2. Program managers design and implement effective internal controls for sub-recipient compliance requirements, with division management oversight;3. Program, financial, and Division managers work together to define sub-recipient determination and decision review responsibilities; and,4. Merge division contracting into DWS central contracting.DWS?s Response:The department will implement the recommendations.

Unallowable HOME Loan Write-Off and Other Improper Accounting Errors(Department of Workforce Services)Federal Agency: Department of Housing & Urban Development (HUD)CFDA Number and Title: 14.239 HOME Investment Partnership ProgramFederal Award Number: M19-SG490100Questioned Costs: $32,081Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/ADuring fiscal year 2020, the HOME program financial managers wrote off a $32,081 single-family loan, which went into foreclosure in 2012, and inappropriately charged the write-off to the HOME Federal Entitlement Fund. We also identified incorrect accounting errors for two of six sampled project transactions?a 33.3 percent error rate. One part of the accounting error indicated that the transaction pertained to the HOME program and another part of the error indicated the transaction pertained to a non-federal program. These errors were not corrected by financial managers approving the transactions.HOME policy requires that program loans considered for write-off from the HOME loan, HOME program income loan, State match loan, or State match program income loan funds ?be `purchased? by state funds then the write-off will be in the state funds and not federal funds in order to recapture the entire federal funds.? Additionally, 2 CFR 200.426 explicitly identifies bad debts as unallowable costs for federal programs and requires states to be ?[consistent] with policies and procedures that apply uniformly to both federally financed and other activities of the non-Federal entity.?Although program managers processed the write-off through the appropriate channels, financial managers relied on unsupported historical bad debt write-off practices that did not conform to the program?s own policy. Financial managers also disregarded established costing and account coding structure applicable to the HOME program. Improper expensing, costing, and coding of program (and non-program) transactions without proper internal controls can result in improper charging of unallowable activities or unallowable costs to the federal program, incorrect recording of loans and subsequent program income, and erroneous reporting. The $32,081 write-off loss, which we have questioned, was taken from a sample population of $1,782,025 and a total population of $10,210,579.Recommendations:We recommend HOME program financial managers:1. Follow established loan write-off policy or receive written federal authorization for the historical practices and update HOME policy accordingly;2. Communicate updated policies to the necessary parties, which could include the Olene Walker Housing Loan Fund Board and the State Division of Finance; and,3. Revise and follow the account coding and costing structure.DWS?s Response:The write-off of the single-family loan cited by the auditors was a conversion of a homebuyer project loan to a grant, as authorized by the Olene Walker Housing Loan Fund Board, for the amount that was unable to be recaptured due to insufficient net proceeds available from the sale of the associated property. The department believes that the treatment of this foreclosure situation is in accordance with applicable federal regulations, guidance in HUD Notice CPD 12-003, and our 2019 Annual Action Plan which was approved by HUD. The State Division of Finance classified the transaction recorded in the State?s general ledger system (FINET) for the conversion of the homebuyer project loan to a grant as a ?special grant? which the auditors cited as an accounting error. The other accounting error cited by the auditors was a result of the department?s financial manager using only the last two digits of the program codes that were recorded in FINET to classify certain HOME Investment Partnerships Program transactions. The department acknowledges that the utilization of the program codes in this way could potentially cause confusion for non-finance personnel looking at the program codes in their entirety for these transactions, but this treatment did not result in any HOME Investment Partnerships Program transactions being classified incorrectly or being recorded in an incorrect fund.

HOME Eligibility and Housing Quality Inspections Not Performed in Accordance with Policy(Department of Workforce Services)Federal Agency: Department of Housing & Urban Development (HUD)CFDA Numbers and Titles: 14.239 HOME Investment Partnership ProgramFederal Award Numbers: M19-SG490100Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AHOME did not perform on-site inspections for 2 of 40 sampled inspections (a 5 percent error rate) within a two-year interval in accordance with the Olene Walker Housing Loan Fund (OWHLF) Program Guidance and Rules. In addition, the new program manager was unaware of the responsibility to establish internal controls as required by Uniform Guidance.OWHLF Program Guidance and Rules, as supported by 24 CFR 92.504(d)(1)(ii), requires frequent inspection based on units in the property (i.e., 5?25 units inspected every 2 years). 2 CFR 300.303 requires non-federal entities to ?establish and maintain effective internal control ? that provides reasonable assurance that the non-federal entity is managing [the program] in compliance with ? terms and conditions of the federal award.?Program staff did not perform the on-site inspections in accordance with OWHLF policy because they tracked inspections manually and incorrectly established future inspection dates, which should have been detected by an internal control. The program manager relied on external reviews and staff experience to ensure compliance with requirements. Division management did not monitor internal controls to identify the missing internal control when staff turned over.A lack of internal controls over single family eligibility determinations and multi-family on-site inspections increases the risk that ineligible recipients receive federally subsidized housing, poor housing conditions, or noncompliance of federal housing subsidies by housing owners or management.Recommendations:We recommend HOME:1. Design and implement internal controls over single and multi-family eligibility determinations and on-site inspections to ensure compliance; and,2. Follow OWHLF written policies and procedures regarding the frequency of multi-family inspections.DWS?s Response:The department will implement the recommendations.

Oversight of Federal Programs Should Be Strengthened(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.575 Crime Victim Assistance16.576 Crime Victim CompensationFederal Award Numbers: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Utah Office for Victims of Crime (UOVC) does not manage the Crime Victim Assistance (CVA) and Crime Victim Compensation (CVC) programs in accordance with federal regulations, potentially jeopardizing future funding and/or reducing UOVC?s ability to assist victims of crime in the state. Uniform Guidance 2 CFR 200.303 (a)-(d) enumerates 4 key areas UOVC must implement to effectively manage CVA and CVC. These areas include:a. Establishing and maintaining effective internal controls;b. Complying with federal statutes, regulations, and federal awards terms and conditions;c. Evaluating and monitoring UOVC?s compliance with (b); andd. Taking prompt action when instances of noncompliance are identified, including those identified in audit findings.Establishing & Maintaining Effective Internal ControlsUOVC has not established or maintained effective internal controls, which include a sound control environment or ?tone at the top?. Elements of a sound control environment (e.g., written policies and procedures, effective application of information technology, and hiring of competent staff) are lacking. The state?s accounting system (FINET) is not utilized in a way to account for federal awards separately. Independent spreadsheets, rather than FINET, are used to managed CVA and CVC. Findings 2020-021, 2020-024, 2020-026, and 2020-027 provide further explanation. UOVC should follow the federal ?Green Book? or the ?Internal Control Integrated Framework? (COSO Framework) to establish and maintain effective internal controls (see 2 CFR 200.303(a)).Complying with Federal Statutes, Regulations, & Federal Award Terms and ConditionsAs enumerated in Findings 2020-019 through 2020-036, UOVC did not comply with federal statutes, regulations, and terms and conditions for the fiscal year ended June 30, 2020. Finding 2020-019 is considered material, or more severe, noncompliance while Finding 2020-020 is required to be reported under Uniform Guidance. Findings 2020-021 through 2020-026, while not required to be reported under Uniform Guidance, indicate other instances of noncompliance.Evaluating & Monitoring Compliance with Federal Statutes, Regulations, & Federal Award Terms and ConditionsUOVC does not evaluate or monitor its compliance with federal statutes, regulations, or award terms and conditions. Typically, organizations utilize an internal audit function to evaluate and monitor compliance. While UOVC has auditors on staff, they are tasked with monitoring subrecipients and do not evaluate or monitor UOVC?s compliance.Taking Prompt Action When Instances of Noncompliance Are IdentifiedThe CVA program has been audited every year since fiscal year ended June 30, 2017 and the CVC program has been audited every year since fiscal year ended June 30, 2018. The following table summarizes the audit findings, including the findings which are considered ?repeat findings? or findings originally identified in a previous audit that had not been corrected.(See Schedule of Findings and Questioned Costs for chart/table)As evidenced by the ?Number of Repeat Findings?, UOVC has not taken prompt action to correct instances of noncompliance identified in audits. While management has made some effort to correct the problems, it has struggled to understand and identify the core issues generating the finding and identifying how to effectively address them.Recommendation:1. Gain an understanding of the federal ?Green Book? or ?COSO Framework? to then design effective internal control, including the establishment of a sound control environment;2. Comply with federal statutes, regulations, and federal award terms and conditions;3. Establish written procedures and assign appropriate personnel to evaluate and monitor UOVC?s compliance with (b); and4. Work with auditors to understand core issues of audit findings in order to take prompt action when instances of noncompliance are identified.UOVC?s Response:UOVC agrees that it can and should strengthen oversight of federal programs.

UOVC Does Not Monitor Grant Expenditures to Ensure Spending in the Proper Period(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.576 Crime Victim CompensationFederal Award Numbers: 2016-VC-GX-0057; 2017-VC-GX-0019; 2018-V1-GX-00262019-V1-GX-0045Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: 2019-015UOVC does not monitor or verify that expenditures charged to the CVC program occurred during each award?s period of performance. Funding for this program is derived from both state and federal resources, is recorded in one fund code in FINET, and includes multiple federal awards, each of which have a four-year period of performance requirement. UOVC does not charge the majority of CVC expenditures to a specific award and does not perform any allocation after the fact. While the 2017 Department of Justice Grants Financial Guide specifically states that for this program there is no financial requirement to identify the source (federal or state) of individual payments to crime victims, it also states ?recipients must account for each award separately.? However, without an allocation or some other way to identify the expenditures to a specific federal award, we could not perform appropriate audit procedures to determine compliance with period of performance requirements. By not adequately tracking spending for period of performance purposes, UOVC could be spending funds outside the allowable period.Recommendation:We recommend UOVC charge expenditures to specific awards, otherwise identify the source (federal or state) of payments to crime victims, or obtain a waiver from the U.S. Department of Justice stating this requirement does not apply to this program.UOVC?s Response:UOVC agrees that it must more clearly designate the revenue source of expenditures to better permit testing and clearly display, verify, and ensure spending in the proper period.

Crime Victim Reparations Determined and Paid without Independent Review(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.576 Crime Victim CompensationFederal Award Numbers: 2016-VC-GX-0057; 2017-VC-GX-0019; 2018-V1-GX-00262019-V1-GX-0045Questioned Costs: $59,564Pass-through Entity: N/APrior Year Single Audit Report Finding Number: 2019-014UOVC Reparation Officers determine allowable expenditures and Payment Technicians process payment of these expenditures without an independent review. The Officers consider multiple factors (e.g., the type of crime, the severity of the crime, potential insurance coverage) when determining the amount of reparations to a victim. Without an independent review of these determinations, UOVC can inconsistently apply state laws and rules when administering the Crime Victim Compensation Program. For example, Utah Code 63M-7-511.5 identifies the maximum per-crime aggregate payments for medical and non-medical reparations by identifying specific crimes and ?aggravated? circumstances which increase the allowed maximum limits. For 7 of 52 claims reviewed, reparation officers decided that these 7 claims qualified for the increased limits despite them not meeting the criteria outlined in Code, when compared to police reports or other supporting documentation. We have questioned $59,564 in payments exceeding the allowed threshold for these 7 claims.Recommendation:We recommend UOVC establish an independent review of crime victim reparation determinations and payments.UOVC?s Response:UOVC agrees that Reparation Officers and Payment Technicians must exercise their independent discretionary statutory authority and obligations within the parameters of the law. UOVC also agrees that Reparation Officers and Payment Technicians are obligated to obtain and retain documentation to support and verify their operation within the law. UOVC further understands that the auditor recommends and encourages increased monitoring and oversight of the independent discretionary statutorily authorized actions of Reparation Officers and Payment Technicians, to assure compliance with the law. UOVC looks forward to being able to fully review the material reviewed by the auditor as we work with the auditors to rectify their concerns. UOVC respects the auditor?s role in questioning these costs in the single audit process.

Administrative Expenditures Exceeded the Allowable 5% Threshold(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.576 Crime Victim CompensationFederal Award Numbers: 2016-VC-GX-0057Questioned Costs: $9,247Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Utah Office for Victims of Crime (UOVC) recorded $9,247 in excess of the allowable 5% administrative expenditures earmark for the VOCA16 award because it has not established internal controls to ensure proper monitoring of the maximum 5% allowed for administrative expenditures. 2 CFR 200.303(a)) states ?The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? Inadequate internal controls over earmarking resulted in unallowable questioned costs of $9,247 and noncompliance with grant allowable cost principles and earmarking requirements.Recommendation:We recommend UOVC establish internal controls to ensure administrative expenditures do not exceed the 5% earmarking limit.UOVC?s Response:UOVC agrees that $9,247 was initially recorded in excess of the allowable 5% and agrees that a lack of internal controls contributed to this. This error required and received correction to assure that the 5% was ultimately not exceeded. UOVC respects the auditor?s role in questioning these costs in the single audit process.

Claims Management System Unable to Provide Accurate Performance Report Data(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.576 Crime Victim CompensationFederal Award Numbers: 2016-VC-GX-0057; 2017-VC-GX-0019;2018-V1-GX-0026; 2019-V1-GX-0045Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: 2019-016The UOVC Claims Management System?s (CMS) current implementation does not provided data in a matter that allows UOVC to accurately report the federally-prescribed performance measures in its quarterly performance reports.? The dollar amount of expenses paid by category and type of crime are not tracked. While UOVC has an October 2015 correspondence from the Department of Justice stating that these items can be reported as ?not tracked?, the correspondence also stated that UOVC should comply as quickly as possible to start tracking the required measurements but did not give an implementation deadline. As of June 2020, these required performance measures are still being reported as ?not tracked.?? The CMS contains different age ranges for four out of six age categories required on the Performance Report. As such, we were unable to calculate the correct number of applicants within the age ranges requested on the Performance Report.UOVC?s CMS should be able to provide accurate performance data. Without properly generating the necessary data, UOVC cannot provide the Department of Justice with the critical information needed to know how this program is being administered to help victims of various crimes.Recommendation:We recommend UOVC reconfigure its system to provide accurate performance report data and run system tests before deployment to ensure the system provides the expected results.UOVC?s Response:UOVC agrees.

Design of Subrecipient Monitoring Procedures Does Not Ensure Compliance with Federal Regulations(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.575 Crime Victim AssistanceFederal Award Numbers: 2016-VA-GX-0052, 2017-VA-GX-0057, 2018-V2-GX-0051Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Numbers: 2019-018As the prime recipient for the Crime Victim Assistance grant, UOVC must establish internal controls over and comply with multiple federal requirements for working with its subrecipients. These requirements and the results of our audit procedures are as follows:Communication of Key Federal Award Information: According to 2 CFR 200.331(a) UOVC must clearly identify to the subrecipient the federal award by providing the required information. Such information should include 13 specific items to be communicated, such as the federal award identification number, federal award date, total amount of federal funds obligated to the subrecipients, and identification of whether the award is Research & Development.UOVC did not communicate the required information for all 12 of the subrecipient contracts we reviewed because it relied on its Grant Management System to generate the subaward agreements and believed the system was including the necessary information. UOVC did not test the vendor-developed system to confirm the system was functioning as expected. When relying on a computer system to perform specific functions, UOVC should test the system prior to deployment to ensure it produces the expected results. As part of a sound IT general control environment, UOVC should also document the results of these tests. If the system is not functioning appropriately and/or until the system is functioning appropriately, UOVC should establish a review process to ensure the required information is communicated.Risk Assessment @ Subrecipient Level: According to 2 CFR 200.331(b), UOVC must evaluate each subrecipient?s risk of noncompliance for purposes of determining the appropriate monitoring (e.g., frequency of desk reviews or on-site visits) related to the award.While UOVC has developed policies and procedures for performing risk evaluations and is performing such evaluations, it has not developed policies and procedures for determining the appropriate monitoring related to the award. There is no link between the risk evaluation being performed and the level of monitoring performed. 28 CFR 94.106 requires UOVC to include a risk assessment plan in its monitoring plan.Desk & On-Site Reviews: According to 28 CFR 94.106, UOVC must perform regular desk monitoring of all subrecipients and on-site monitoring at least once every two years, unless a different frequency is determined based on the risk assessment mentioned above.UOVC staff involved in conducting both the desk and on-site monitoring ensure UOVC complies with federal rules. However, UOVC does not have an independent verification or review of monitoring procedures and results. UOVC believed that the two auditors working together was enough coverage to make sure the monitoring happened. With no independent review, the auditors may miss certain aspects of the monitoring process and/or fail to comply with federal monitoring rules.Review of Subrecipient Single Audits: According to 2 CFR 200.521, UOVC should review and give management decisions on subrecipient single audit results within 6 months of the subrecipient?s report submission.The UOVC staff involved in the desk and on-site monitoring also review subrecipient single audit reports. UOVC does not have a control in place to ensure the reviews and management decisions are completed within the 6 months allowed. For 1 of 12 subrecipients, UOVC did not review the most recent report. By not making sure the reviews are happening in a timely manner the passthrough entity could review a single audit after the 6 month window and thus become noncompliant with the risk of losing federal funds.Inadequately designed subrecipient monitoring procedures may restrict UOVC?s ability to identify subrecipients? noncompliance with federal regulations.Recommendation:We recommend UOVC:1. Test computer system development prior to deployment, document the results of these tests, and, until the system is functioning properly, establish a review process to ensure required information is communicated to subrecipients;2. Expand its risk assessment policies and procedures to identify the appropriate levels of monitoring for each risk level;3. Have a person independent of the desk monitoring, on-site monitoring, and subrecipient single audit report monitoring review results and timing of monitoring efforts.UOVC?s Response:UOVC agrees that monitoring policies must ensure compliance with federal regulations. UOVC is eager to work with the auditor to review, understand, and resolve each of the auditors? key concerns articulated with this finding.

Federal Cash Draws Calculated Using Employee-Prepared Spreadsheet Instead of General Ledger(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.575 Crime Victim AssistanceFederal Award Numbers: 2017-VA-GX-0057Questioned Costs: $0Pass-through Entity: 0Prior Year Single Audit Report Finding Number: PY-2019-019One of the cash draw requests tested (a 14% error rate) included errors that had a net effect of $27,036 being underdrawn for the Crime Victim Assistance program (CVA). UOVC calculates the federal cash draws using an employee-prepared spreadsheet instead of the state?s general ledger, or FINET. Because FINET captures all financial activity for the CVA, UOVC should use FINET data to prepare cash draws in a consistent manner. UOVC should also be completing thorough reviews of each draw to ensure draws are prepared in a consistent manner, on a reimbursement basis, and include proper coding; and the timing of the draw is in compliance with 31 CFR part 205. UOVC?s current procedures allow for inconsistency in capturing expenditures and requesting incorrect reimbursement amounts from the federal government. Continuing current practices could result in noncompliance with federal cash management requirements.Recommendation:We recommend UOVC uses FINET data to prepare draws and thoroughly review draws prior to requesting reimbursement.UOVC?s Response:UOVC agrees that FINET data is the only acceptable data for preparing cash draws and that the use of employee generated data for this purpose is neither allowable nor acceptable. UOVC is eager to fully review the information supporting this finding and thoroughly resolve this finding.

Subrecipient-Reported Information Not Adequately Verified(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.575 Crime Victim AssistanceFederal Award Numbers: 2016-VA-GX-0052; 2017-VA-GX-00572018-V2-GX-0051; 2019-V2-GX-0063Questioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Numbers: 2019-017UOVC does not perform procedures to verify the information reported on the U.S. Department of Justice, Office for Victims of Crimes Annual Performance Measurement Tool (PMT) Report. This information is used to ensure the requirements are met related to the 30 percent minimum level of effort for priority categories of crime victims and the 10 percent minimum level of effort for previously underserved victims of violent crimes. As part of its monitoring procedures, UOVC selects one of a subrecipients reimbursement requests, obtains supporting documentation for the reported amounts, including level of effort amounts, and performs a desk audit to determine the validity of the numbers reported. These desk audits focus on a single reimbursement request by a subrecipient and do not determine the validity of all amounts reported.Because UOVC does not obtain and review supporting documentation for all necessary data elements, we were unable to determine whether UOVC actually met the 30 percent priority category and 10 percent previously underserved level of effort requirements. All information submitted on the Annual PMT Report should be verified either by obtaining and reconciling supporting documentation to the reported amounts or by performing other procedures to validate the accuracy of the reported amounts and other performance measures submitted by the subrecipients. Inaccurate information on the Annual PMT Report, whether provided to UOVC by the subrecipients or reported by UOVC, could permit program purposes and performance measures to be overlooked or ignored without detection and could potentially affect future program funding.Recommendation:We recommend UOVC establish procedures to verify the amounts reported by subrecipients on the Annual PMT Report, particularly those related to level of effort requirements.UOVC?s Response:UOVC agrees that it is critically important that UOVC adequately verifies subrecipient-reported information. UOVC also agrees that it is critically important that UOVC assure compliance with priority category and level of effort requirements. UOVC is eager to work with the auditor to achieve understanding and resolution of the specific concerns articulated by the auditor in this finding.

Grant Expenditures Recorded Outside the Allowable Spending Period(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.575 Crime Victim AssistanceFederal Award Numbers: 2016-VA-GX-0052Questioned Costs: $9,103Pass-through Entity: N/APrior Year Single Audit Report Finding Numbers: N/AThe Utah Office for Victims of Crime (UOVC) recorded $9,103 in expenditures after the VOCA16 award?s December 31, 2019 close-out deadline because it used an employee-generated spreadsheet to track administrative expenditures. The spreadsheet did not reconcile to FINET. 2 CFR 200.303(a)) state, ?The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? Inadequate internal controls over period of performance resulted in questioned costs of $9,103 and noncompliance with grant requirements.Recommendation:We recommend UOVC either:1. Use FINET to track and cap administrative expenses to 5%; or2. Have a person, independent of the spreadsheet preparation, reconcile the employee-prepared spreadsheet to FINET.UOVC?s Response:UOVC agrees that expenditure adjustments were recorded outside the allowable spending period of the grant. UOVC also agrees that as a result of inadequate internal controls, $9,103 in allowable expenditures occurring within the allowable spending period were internally adjusted and therefore recorded outside of the allowable spending period. UOVC respects the auditor?s role in questioning these costs in the single audit process.

Quarterly Financial Report Did Not Agree to Accounting System(Commission on Criminal and Juvenile Justice)Federal Agency: Department of JusticeCFDA Number and Title: 16.575 Crime Victim AssistanceFederal Award Numbers: 2016-VA-GX-0052; 2017-VA-GX-00572018-V2-GX-0051; 2019-V2-GX-0063Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Numbers: 2019-017UOVC prepared its quarterly financial reports using amounts from its Grant Management System (GMS) rather than using information recorded in State?s accounting system (FINET). The 2016 Award?s September 30, 2019 final SF-425 Report Line 10.j. reported $5,572,590.68 which agreed to a client-prepared standalone spreadsheet maintained outside FINET, which crashed and needed to be rebuilt. Therefore, we could not agree the report to FINET. The amounts on the federal financial reports should agree to FINET. This practice could permit improper amounts to be reported on the SF-425 without detection, which could potentially affect future program funding.Recommendation:We recommend UOVC use FINET data to populate amounts reported on financial reports.UOVC?s Response:UOVC agrees that line 10.j. of the described federal form does not agree to the information recorded in the state?s accounting system (FINET). Though FINET does not contain and cannot provide the information for line 10.j. of the described federal form, UOVC is eager to work with the auditor to assure that all reports are completed using FINET and all appropriate accounting and recording practices are otherwise used to assure all federal financial reports are complete and accurate according to FINET.

Mandatory Benefit Overpayment Detection Matches Not Performed for Pandemic Unemployment Assistance(Department of Workforce Services)Federal Agencies: Department of LaborCFDA Numbers and Titles: 17.225 Unemployment InsuranceFederal Award Numbers: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Numbers: N/AThe Unemployment Insurance Division (UI) at the DWS did not perform the three mandatory overpayment detection cross-match procedures for claims under the Pandemic Unemployment Assistance program (PUA) during fiscal year 2020. Additionally, UI did not design or implement internal controls to ensure performance and compliance of such procedures.The Department of Labor issued Unemployment Insurance Program Letter (UIPL) No. 23-20 to identify three mandatory overpayment detection functions for state programs, including PUA, to be performed in the same manner as for regular Unemployment Insurance programs. 2 CFR 200.303 requires UI to establish and maintain effective internal controls to provide reasonable assurance that it manages Federal programs in compliance with award terms and federal requirements.UI could not meet the federal requirement in an effective and timely manner because it could not instantaneously develop the cross-match procedures effectively in its system, while addressing a historic and unprecedented claim volume. Non-performance of the mandatory cross-match procedures to identify potential and actual benefit overpayments subjects the federal program funds to fraud or error that may remain undetected.Recommendation:We recommend UI complete the following:1. Design and implement appropriate cross-match procedures to ensure timely compliance with federally mandated overpayment detection requirements; and2. Perform required cross-matches retroactively and prospectively to identify and resolve any PUA overpayments.DWS?s Response:DWS concurs with the finding and appreciates the work of the audit team in reviewing the overpayment detection efforts in the Pandemic Unemployment Assistance (PUA) program. The PUA program was a new program created by the CARES Act and was stood up by the department on April 15, 2020. As stated in the finding, DWS was unable to comply with all program requirements in a timely manner, due to the unprecedented demand caused by the pandemic and the need to create this and many additional stimulus programs. However, DWS has since implemented the three mandatory overpayment cross-match procedures and ran them retroactively to verify the accuracy of all previously made PUA payments.

Incorrect Calculation of Pandemic Unemployment Assistance Benefits Results in Overpayment(Department of Workforce Services)Federal Agency: Department of LaborCFDA Number and Title: 17.225 Unemployment InsuranceFederal Award Numbers: VariousQuestioned Costs: $1,450Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe UI Division incorrectly calculated the weekly benefit amount for Pandemic Unemployment Assistance Program (PUA) recipients. For one claimant in a sample of 40, UI calculated the benefit on the claimant?s gross income instead of the claimant?s net income amount. The error resulted in an overpayment of $145 in a total sample of $32,429, which was taken from a total PUA benefit population of $128,238,515. There was an additional $1,305 in total weekly benefits incorrectly paid to this claimant for a total of $1,450, which we have questioned.20 CFR 625.6(a)(2) requires the weekly benefit amount for claimants to be calculated based on the claimant?s net income amount. An increased caseload and evolving program guidance caused the caseworker to incorrectly calculate benefits. Incorrect benefit calculation without detection by internal controls could result in significant overpayment to program claimants and waste funds.Recommendation:We recommend UI perform retroactive reviews of its PUA claims to ensure proper income determination and benefit calculation occurred.DWS?s Response:DWS concurs with the finding and appreciates the valuable information provided by the audit team.

Oversight of Federal Program Should Be Strengthened(Governor?s Office of Management and Budget, formally known as Governor?s Office of Planning and Budget as of May 1, 2021)Federal Agency: Department of the TreasuryCFDA Number and Title: 21.019 Coronavirus Relief FundFederal Award Number: N/AQuestioned Costs: $0Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Governor?s Office of Management and Budget (GOMB) did not have adequate federal grant management experience when the State received $943 million in Coronavirus Relief Fund (CRF) monies to aid in the State?s response to the pandemic. As a result, during fiscal year 2020 (FY20), its internal controls over compliance with CRF requirements were insufficient. 2 CFR 200.303(a) states that all federal grant recipients must establish and maintain effective internal controls to effectively manage a federal grant program.Elements of a sound internal control system (e.g., adequate knowledge or experience of key managers to discharge their responsibilities, adequate and effective training, written policies and procedures) were insufficient. For example,? GOMB, which does not typically manage federal programs, was charged with quickly disbursing the grant monies to state agencies and local governments, such as counties and cities.? Guidance provided to state agencies was inconsistent with guidance provided to participating local governments regarding how these entities could spend CRF monies.? The state agencies? use of required account coding when recording CRF transactions was not consistently enforced.? Written policies and procedures outlining how its staff would manage the grant did not exist, particularly with regards to its monitoring of participating local governments, or subrecipients (see Finding No. 2 for further discussion).A lack of effective controls over compliance with CRF federal regulations may allow unallowable items to be charged to the program. See Findings 2 and 3 for further discussion.Recommendation:GOMB could strengthen its grant management oversight by:1. Delegating the management of large federal programs to a state agency where managers have adequate experience with managing federal programs;2. Hiring personnel with federal grant management experience; or3. Gaining an understanding of the federal ?Green Book? or ?COSO Framework? to then design effective internal control, including the establishment of a sound control environment.GOPB?s Response:The Governor?s Office of Planning and Budget (GOPB) agrees with this finding.As the COVID-19 pandemic escalated in March 2020 and Congress quickly enacted the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), Utah, along with other states, responded with urgency. Given the compressed timing of the enactment of the CARES Act, and the necessary timely distribution of aid, GOPB, then going by the name of the Governor?s Office of Management and Budget (GOMB), was not structured with a compliance framework to execute an unprecedented federal grant program of that magnitude. Where possible, GOMB delegated grant distribution and management to agencies with grant management experience, including the Department of Health. However, since the State of Utah was the prime recipient of CRF funds, GOMB was ultimately responsible for managing these funds. Given the scope period of this audit, ending in June 2020, we agree that GOMB did not have federal grant management experience commensurate with the extraordinary responsibilities with which it was charged at that time.

Weaknesses in Monitoring of Local Governments? Coronavirus Relief Fund Activity(Governor?s Office of Management and Budget)Federal Agency: Department of the TreasuryCFDA Number and Title: 21.019 Coronavirus Relief FundFederal Award Number: N/AQuestioned Costs: $14,415,392Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AAs the prime recipient for $943 million in CRF funding, GOMB did not completely fulfill its responsibilities in monitoring the participating local governments? CRF spending as of June 30, 2020. These responsibilities, as outlined in 2 CFR 200.332, include communicating key federal grant information to participating local governments, evaluating each local government?s risk of not complying with grant requirements, and monitoring each local government?s compliance with CRF requirements.Communication of Key Federal Grant InformationGOMB required each local government to complete a ?State of Utah Coronavirus Relief Fund Local Government Allocation Agreement? (Agreement) prior to subaward. However, the Agreement did not contain all information required to be communicated, nor was the missing information subsequently communicated. The requirements that were not communicated in the subaward include the Subrecipient?s DUN?s number (which must match registered name in DUNS); pass-through entity, and contact information for awarding official; and identification of whether the award is R&D (see 2 CFR 200.332(a)).Risk Evaluation & Monitoring ComplianceDuring FY20, GOMB and the Department of Administrative Services (DAS) informally assessed these local governments as high risk. While funds were not disbursed until mid-June and monitoring of activity would have been minimal for FY20, GOMB and DAS did not establish formal monitoring procedures based on the risk evaluation. 2 CFR 200.332(b) required GOMB to establish a risk assessment process and to determine the appropriate level of monitoring based on risks.The Agreement with each local government identified key terms and conditions as to 1) the use of funds, and 2) the reporting of expenditures using the State?s financial transparency website. As no monitoring had been performed, we reviewed the expenditures for 17 local governments. These local governments reported the highest amount of CRF spending through June 30, 2020.Use of FundsAccording to the Agreement (and in accordance with the 2020 Compliance Supplement), ?permissible use of the funds may only be used to cover costs that [met] the following conditions:? Are necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19)? Were not accounted for in the recipient?s budget most recently approved as of March 27, 2020 (the date of enactment of the CARES Act) for the recipient; and,? Were incurred during the period that begins on March 1, 2020 and ends on December 30, 2020.?Of the 17 selected local governments, the following 8 did not have adequate supporting documentation to support the ?necessary expenditure? (or ?substantially dedicated?) conclusion with respect to its employees, and all public safety and public health payroll costs were charged to the program. Therefore we are questioning the following payroll expenditures:(See Schedule of Findings and Questioned Costs for chart/table)In our scanning of the general ledger detail for the 17 local governments, we identified 7 unusual expenditures, which we are questioning.(See Schedule of Findings and Questioned Costs for chart/table)Financial Transparency WebsiteThe Agreement?s Terms and Conditions Section VI states ?The recipient is required to report CRF expenditures in quarterly data uploaded to Transparent Utah. CRF Expenditures shall be identified using a Uniform Chart of Accounts Coding Block for local entities...? Of the 17 selected local governments, 3 were delinquent (not posted to transparency) and 7 had a discrepancy between their G/L and the information uploaded to Transparent Utah. Consequently, transparency amounts were underreported by $3,174,586. We have not questioned these costs as this is not a federal grant requirement.While GOMB considered itself a ?banker,? it did not consider itself a prime recipient responsible for ensuring local government compliance with CRF regulations. GOMB should communicate the necessary information to each participating local governments, establish written procedures for monitoring those local governments based on a formal risk assessment process, and should monitor the local governments for compliance with key terms and conditions in the Agreement. The lack of monitoring or oversight has resulted in and may continue to result in material amounts of CRF funding paying for non-essential expenditures.Recommendation:We recommend GOMB:1. Communicate all required federal award information to participating local governments;2. Establish written procedures for monitoring participating local governments; and,3. Enforce key terms and conditions in agreements with local governments.GOPB?s Response:GOPB agrees with this finding.We agree that GOMB and DAS did not establish formal monitoring procedures based on a risk evaluation prior to disbursements of funds. This was largely due to the expedited distribution needs of the CARES Act. While no formal written risk evaluation was developed prior to the distribution of local CRF funds, there were efforts made to contemplate risk during the audit period. GOMB discussed ways to balance risks and the extensiveness of reporting and monitoring, allowing local governments to meet emergency needs in a timely manner. For example, GOMB, the Division of Finance, and Treasurer?s Office partnered to implement a payment verification process to verify that the proper amount of funding was being disbursed to accounts belonging to recipients.When the Treasury Department disbursed CRF funds to Utah in April 2020, many elements of a typical federal grant award, including guidance on permitted use, the collection of DUNS numbers and other information about subrecipients, reporting requirements, and a Catalog of Federal Domestic Assistance number, were not made available. Additionally, other CRF information, including a formal terms and conditions document and a Federal Award Identification Number have never been provided by the Treasury Department to Utah or other states.A great deal of care was made to communicate the information available at that time to subrecipients. Before disbursing funds to cities and counties, GOMB created the ?State of Utah Coronavirus Relief Fund Local Government Allocation Agreement? (Agreement) to communicate the requirements of accepting and using CRF funds. This Agreement was reviewed by the following entities before being finalized: Office of the Legislative Fiscal Analyst, Office of the State Auditor, Office of State Treasurer, Office of the Attorney General, Division of Finance, Utah League of Cities and Towns (ULCT), and Utah Association of Counties (UAC). The Agreement contained all available information from the Treasury to local governments and indicated that local governments were responsible for complying with all future guidance.A key component of the ?State of Utah Coronavirus Relief Fund Local Government Allocation Agreement? was the requirement to identify CRF transactions in regular quarterly https://transparent.utah.gov/ reporting. Because cities and counties had CRF funding for less than a month before the end of the first reporting quarter and were also navigating consistently changing Treasury Department guidance, GOPB acknowledges that these subrecipients had difficulty meeting the initial quarterly reporting requirement. GOPB has continued to work with staff from the Office of the State Auditor?s, which manages the reporting portal, to identify incomplete reporting. While the Office of the State Auditor has served as a technical resource, GOPB recognizes its responsibility to follow up on incomplete expenditure data, so complete and accurate data can be used to facilitate subrecipient monitoring.

Errors in Reimbursements to State Agencies(Governor?s Office of Management and Budget)Federal Agency: Department of the TreasuryCFDA Number and Title: 21.019 Coronavirus Relief FundFederal Award Number: N/AQuestioned Costs: $14,800Pass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AWith inconsistent application of accounting coding structures and unclear understanding of which expenditures would meet CRF program objectives and compliance requirements, the Department of Heritage and Arts (DHA), as approved by GOMB, used $14,800 of CRF funds for payroll costs that appear to not be ?substantially dedicated to? the State?s response to the COVID-19 pandemic. GOMB relied on state agencies using proper coding and having a proper understanding as to the appropriate use of funds as it reviewed and approved reimbursement requests. We noted the following errors with DHA?s payroll costs and two additional instances where GOMB did not review and approve reimbursement requests.Payroll CostsGOMB approved a reimbursement to the DHA for estimated payroll costs of $14,800. The State?s Division of Finance (Finance) established account coding for all payroll costs related to the State?s pandemic response. Such costs should have been coded to ?COVI? but the $14,800 was an estimation of payroll costs rather than actual costs recorded. Because DHA estimated this amount, it could not provide documentation of how the payroll costs were used in the response to COVID-19. Appendix VII of the 2020 Compliance Supplement states ?the relevant unit of government should maintain documentation of the `substantially dedicated?? conclusion with respect to its employees.? As there is no supporting documentation, we will question all of these payroll costs.Reimbursement Review & Approval ErrorsGOMB failed to review two reimbursements from state agencies. GOMB?s review of state agency reimbursement requests is considered a key control as the review looks at detailed transactions for compliance with CRF program objectives. These two reimbursement requests were sent directly to State Finance for approval without first going to GOMB for its review of underlying expenditures. The reimbursement requests included improper coding which electronically routed the transactions directly to Finance.Recommendation:We recommend GOMB:1. Approve reimbursements only after a state agency has used the correct account coding; and,2. Continue to educate state agencies on the proper use of CRF funding and the documentation they should maintain.We recommend DHA:1. Use proper coding for COVID related expenditures, including payroll; and,2. Maintain supporting documentation for reimbursement requests, including how the expenditures is COVID-19 related and what the employee did that was related to COVID-19.GOPB?s Response:GOPB agrees with this finding.GOPB acknowledges the documented decision and that the confirmation of actual hours worked was not provided to GOMB during the audit period. GOPB has since confirmed the actual hours worked and has received the documentation of the decision to deem these employees as ?substantially dedicated.?

Inadequate Controls Over and Noncompliance with Subrecipient Monitoring Requirements(Department of Environmental Quality)Federal Agency: Environmental Protection AgencyCFDA Number and Title: CFDA 66.202 Congressionally Mandated ProjectsFederal Award Number: EM 96838601Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AWe reviewed the sub-award contract for the Congressionally Mandated Projects (Program) and noted insufficient documented controls over the desk and on-site monitoring reviews, as well as review and follow-up of the subrecipient?s Single Audit.We noted that the Department does not have a sufficient control over evaluation of subrecipient risk or communication of required sub-award information as required by 2 CFR section 200.332. Due to the insufficient controls, we noted the following noncompliance:a. The Department did not complete an evaluation of subrecipient risk. 2 CFR section 200.332(b) states that the passthrough entity must ?evaluate each subrecipient?s risk of noncompliance with Federal statues, regulations, and the terms and conditions of the sub-award for purposes of determining the appropriate subrecipient monitoring.? Although the Department was performing other monitoring procedures, they were unaware of the risk evaluation being required. By not performing an evaluation of risk for each subrecipient, the Department may not be appropriately monitoring the subrecipient.b. The sub-award contract was missing four of the 13 required elements at the time of the sub-award. 2 CFR section 200.332(a)(1) states that the passthrough entity must clearly identify the sub-award by including 13 various federal award identification elements. The Department staff believed they had included all items on the sub-award contract at the time of the sub-award and was unaware of missed elements. By not clearly identifying the sub-award information to the subrecipient, the subrecipient may not be aware of all Federal guidelines for the award.Recommendation:1. We recommend the Department implement a system of documented internal controls to ensure:2. desk and onsite monitoring reviews are being completed as required by 2 CFR section 200.332(d),3. reviews of the subrecipient?s Single Audit results and follow-up are being completed as required by 2 CFR section 200.332(d)(3),4. an appropriate evaluation of risk is being completed for each subrecipient as required by 2 CFR section 200.332(b), and5. the sub-award contract clearly identifies all the required elements in accordance with 2 CFR section 200.332(a)(1).DEQ?s Response:We agree that the department?s contract with the subrecipient was missing 4 of the 13 required elements of the federal award for proper identification. We also agree that the department needs to conduct and document a formal risk assessment and subsequent monitoring efforts for subrecipients. We did informally assess the risk of the subrecipient?s ability to conform with the requirements of the program and we determined and conducted various monitoring activities as a result. These included audits by our internal auditor, field visits, and detailed review of supporting documentation. We also reviewed the subrecipient?s annual single audit report.

Lack of Control Over Suspension and Debarment(Department of Environmental Quality)Federal Agency: Department of Environmental QualityCFDA Number and Title: CFDA 66.202 Congressionally Mandated ProjectFederal Award Number: EM - 96877701EM - 96877501EM - 96877601EM - 96838701EM - 96838601Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Department does not have a control in place to verify that vendors and subrecipients receiving funds under the Congressionally Mandated Projects are neither suspended nor debarred. 2 CFR 180.300 requires that before entering into a covered transaction, the Department verify that vendors are not excluded or disqualified by: (a) checking the Excluded Parties List System (EPLS) maintained by the U.S. Government System for Award Management (SAM), (b) collecting a certification from the entity, or (c) adding a clause or condition to the agreement with the entity. The Department believed that another department was verifying suspension and debarment. The lack of control could lead to the Department using or paying a vendor or subrecipient who is suspended or disbarred.Recommendation:We recommend the Department design and implement an adequate control over suspension and debarment to ensure that vendors and subrecipients receiving federal funds are not suspended or debarred.DEQ?s Response:We agree with the finding and recommendation. We have a suspension and debarment clause in our standard terms and conditions but those were not attached to the contracts in question. The contracts in question were designed with the assistance from the Office of the Attorney General and that particular clause was not included nor did we perform a check against the Excluded Parties List System.

Incorrect Sub-Recipient and Contractor Determinations(Department of Environmental Quality)Federal Agency: Environmental Protection AgencyCFDA Number and Title: CFDA 66.202 Congressionally Mandated ProjectsFederal Award Number: EM 96838701Questioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Number: N/AThe Department has not established a procedure to properly identify a service provider as either a vendor or a subrecipient. 2 CFR section 200.331 states that ?a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor.? The Department inappropriately determined two vendors as subrecipients. However, based on the terms of the agreement and actual services provided by the vendors, both relationships were that of a contractor. The correct determination is critical to guarantee that proper monitoring of federal funds is performed.Recommendation:We recommend the Department develop a process to properly classify federally-funded contractual relationships as either subrecipients or contractors.DEQ?s Response:The Department does have a process to properly classify federally funded contractual relationships as subrecipients or contractors. In this particular case the person completing the checklist thought that due to the contactor being another governmental entity it should have been classified as a subrecipient. That understanding was incorrect.

Working Capital Reserves in Excess of Federal Guidelines(Department of Administrative Services)Federal Agencies: VariousCFDA Numbers and Titles: VariousFederal Award Numbers: VariousQuestioned Costs: UndeterminablePass-through Entity: N/APrior Year Single Audit Report Finding Numbers: 2019-023; 2018-033; 2017-021; 2016-037; 2015-048; 2014-040; 2013-049; 2012 12-51; 2011 11-56As of June 30, 2020, two funds within the Department of Administrative Services held working capital reserves in excess of federal guidelines as follows: (See Schedule of Findings and Questioned Costs for table)2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes in each internal service fund. The excess reserves were due to the inherent difficulty of accurately estimating expenses when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves.Recommendation:Depending on the business requirements, we recommend that the Department of Administrative Services reduce excess working capital reserves within each of the respective funds, or obtain a waiver from the federal cost negotiator allowing for an increase in the number of days of working capital allowed to comply with federal guidelines.DAS?s Response:Annually, the Department of Administrative Services (Department) analyzes reserves and estimated costs to determine a rate that reduces and minimizes excess reserves. However, these rates are determined and legislatively approved months in advance of the rate being applied and cannot be changed until the next annual rate setting cycle. Due to these timing differences, rates applied may not reflect new and unforeseen circumstances, resulting in excess or insufficient reserves. The Department makes every effort to adjust future rates to reflect changing circumstances and to minimize potential excess reserves.

Working Capital Reserves in Excess of Federal Guidelines(Department of Human Resource Management)Federal Agencies: VariousCFDA Numbers and Titles: VariousFederal Award Numbers: VariousQuestioned Costs: UndeterminablePass-through Entity: N/APrior Year Single Audit Report Finding Numbers: 2019-024; 2018-034; 2017-022; 2016-038; 2015-049; 2014-041As of June 30, 2020, the Department of Human Resource Management held working capital reserves in excess of federal guidelines as follows: (See Schedule of Findings and Questioned Costs for table)2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes in each internal service fund. The excess reserves are due to the inherent difficulty of accurately estimating expenses when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves.Recommendation:Depending on the business requirements, we recommend that the Department of Human Resource Management reduce excess working capital reserves within each of the respective funds or obtain a waiver from the federal cost negotiator allowing for an increase in the number of days of working capital allowed to comply with federal guidelines.DHRM?s Response:The Department of Human Resource Management (DHRM) agrees with the findings.1. DHRM is aware that the working capital reserves held in retained earnings exceeded the allowable 60 days of cash expenses on June 30, 2020 at the fund level due to excess reserves in Payroll Field Services.

Working Capital Reserves in Excess of Federal Guidelines(Department of Technology)Federal Agencies: VariousCFDA Numbers and Titles: VariousFederal Award Numbers: VariousQuestioned Costs: UndeterminablePass-through Entity: N/APrior Year Single Audit Report Finding Number: 2019-025; 2018-035As of June 30, 2020, the Department of Technology Services held working capital reserves in excess of federal guidelines as follows: (see Schedule of Findings and Questioned Costs for table)2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes in each internal service fund. The excess reserves were due to the inherent difficulty of accurately estimating expenses when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves.Recommendation:Depending on the business requirements, we recommend that the Department of Technology Services reduce excess working capital reserves within each of the respective funds or obtain a waiver from the federal cost negotiator allowing for an increase in the number of days of working capital allowed to comply with federal guidelines.DTS?s Response:We agree with the finding

Working Capital Reserves in Excess of Federal Guidelines(Public Employees Health Program)Federal Agencies: VariousCFDA Numbers and Titles: VariousFederal Award Numbers: VariousQuestioned Costs: UndeterminablePass-through Entity: N/APrior Year Single Audit Report Finding Numbers: 2019-026; 2018-036; 2017-023; 2016-039; 2015-050; 2014-042; 2013-050; 2012-53; 2011-58As of June 30, 2020, the Public Employees Health Program (PEHP) held working capital reserves in excess of federal guidelines as follows below. The audited PEHP statements include a one-time negative expense amount for the Long-Term Disability program, and therefore no useful calculation of excess days could be performed for that program. (See Schedule of Findings and Questioned Costs for table)2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes. The excess reserves were due to the inherent difficulty of accurately estimating expenses. Excess reserves could result in a federal liability since federal programs share an interest in the reserves.Recommendation:Depending on the business requirements, we recommend that PEHP reduce excess working capital reserves or obtain a waiver from the federal cost negotiator allowing an increase in the number of days of working capital allowed to comply with federal guidelines.PEHP?s Response:State Medical ?Due to the unknown nature and risks associated with health care costs due to the COVID-19 pandemic, PEHP will request Cost Allocation Services (CAS) allow an additional two years to study claims and health care cost trends related to COVID-19. Although we have promising news regarding vaccines, it remains very unclear how effective they will work and how many people are willing to get them and any long-term side effects. It also remains very unclear how long it will take for medical procedures to resume at normal levels. If reserves in this program are still above federally allowed amounts as of June 30, 2022, PEHP will either issue a refund to employers and subscribers or refund the federal portion.State Dental ? PEHP had previously agreed with CAS if there were excess reserves at June 30, 2019, PEHP would refund the federal portion. This agreement, however, was made prior to the COVID-19 pandemic. Due to COVID-19, dental claim costs were well below expectations due to guidance given from the CDC regarding delaying elective procedures, surgeries, and non-urgent outpatient visits. The expected outlook is unclear as it relates to expected dental claims due to the delay of non-urgent care dental visits. PEHP will request Cost Allocation Services (CAS) allow an additional two years to study claims and dental costs trends related to COVID-19. If reserves in this program are still above federally allowed amounts as of June 30, 2022, PEHP will either issue a refund to employers and subscribers or refund the federal portion.Long-term Disability ? The COVID-19 pandemic may cause several our insureds to become disabled and thus cause a large increase in claims and a severe reduction in the reserves of this program. Therefore, PEHP will request CAS allow an additional two years to study claim and health care cost trends related to COVID-19. If reserves still exist above the federally allowed amounts as of June 30, 2022, PEHP will either issue a rebate to subscribers or refund the federal portion.Medicare Supplement ? PEHP had previously agreed with CAS if there were excess reserves at June 30, 2020, PEHP would refund the federal portion. This agreement, however, was made prior to the COVID-19 pandemic. This program is for people age 65 and older and these insureds, due to their age and higher likelihood of having serious medical conditions, are at greater risk of becoming seriously ill and incurring large medical claims if they are infected with COVID-19. Because of this, PEHP will request CAS allow an additional two years to study Medicare supplement claims and health care cost trends related to COVID-19. If reserves still exist above the federally allowed amounts as of June 30, 2022, PEHP will either issue a rebate to subscribers or refund the federal portion.

Oversight of Federal Programs Administered in the HCD and ASD Divisions Should Be Strengthened(Department of Workforce Services)Federal Agencies: VariousCFDA Numbers and Titles: VariousFederal Award Numbers: VariousQuestioned Costs: N/APass-through Entity: N/APrior Year Single Audit Report Finding Numbers: N/AThe Housing and Community Development Division (HCD) at the Department of Workforce Services (DWS) did not manage the Home Investment Partnership program (HOME) and the Low-Income Home Energy Assistance program (LIHEAP) in accordance with federal regulations, potentially jeopardizing future funding and/or reducing HCD?s ability to assist those supported by its programs throughout the State of Utah.2 CFR 200.303 (Uniform Guidance) identifies four key areas HCD must implement to effectively manage federal programs. These areas include:a. Establishing and maintaining effective internal controls;b. Complying with federal statutes, regulations, and federal award terms and conditions;c. Evaluating and monitoring compliance with (b); and,d. Taking prompt action when instances of noncompliance are identified, including those identified in audit findings.Establishing & Maintaining Effective Internal ControlsHCD and its financial managers in the Administrative Support Division (ASD) have not established or maintained effective internal controls, which include a sound control framework or ?tone at the top.? Deficient critical elements of a sound control framework include:a. Clearly defined program and financial management responsibilities;b. Adequate knowledge, experience, and supervision for program and financial management to perform their responsibilities and adhere to program requirements and established policies;The table below identifies instances in which HCD and its financial managers in ASD did not have a sound internal control framework to ensure compliance with federal statutes, regulations, and terms and conditions. Findings 2020-009, 2020-015, 2020-016, and 2020-017 are considered material, or more severe, weaknesses while Findings 2020-014, 2020-010, 2020-011, and 2020-002 are considered significant deficiencies in internal controls. (see schedule of findings and questioned costs for table)Complying with Federal Statutes, Regulations, & Federal Award Terms and ConditionsAs identified in the table above, HCD and its financial managers in ASD did not comply with federal statutes, regulations, and terms and conditions, as well as the Department?s own policies for the fiscal year ended June 30, 2020. Findings 2020-015 and 2020-009 are considered material noncompliance while Findings 2020-016 and 2020-010 are required to be reported under Uniform Guidance. Findings 2020-011 and 2020-017, while not required to be reported under Uniform Guidance, indicate other instances of noncompliance.Evaluating and Monitoring ComplianceDivision management for HCD and its financial managers did not perform evaluation and monitoring activities or these activities were insufficient, as identified in Findings 2020-015, 2020-016, 2020-009, and 2020-011. These findings illustrate circumstances where evaluation and monitoring activities did not ensure adherence to established policies and/or established internal controls.Taking Prompt Action to Resolve NoncomplianceCommunication of noncompliance through reports, findings, etc., with all responsible parties allows for prompt and complete action towards resolution. Findings 2020-015 and 2020-014 identify facts and circumstances that were not communicated or resolved in a timely manner by HCD and its financial managers.Recommendation:We recommend HCD and its financial managers:1. Gain an understanding of the federal ?Green Book? or ?COSO Framework? to then design effective internal control including the establishment of a sound control environment and effective risk assessment procedures;2. Comply with federal statutes, regulations, federal award terms and conditions, and internal policies;3. Perform evaluation and monitoring activities to assess operational quality and on-going performance of internal controls to ensure reasonable compliance; and4. Promptly take action to address instances of noncompliance and deficiencies of internal controls.DWS?s Response:The department has an established system of internal controls which is designed to provide reasonable assurance, not absolute assurance, that the department?s objectives will be achieved. It appears that the established internal controls that should have prevented and/or detected the errors cited by the auditors did not function as designed.

Cost Allocation Plan Implementation Errors(Department of Workforce Services)Federal Agencies: VariousCFDA Numbers and Titles: VariousFederal Award Numbers: VariousQuestioned Costs: $108,176Pass-through Entity: N/APrior Year Single Audit Report Finding Numbers: PY-2019-027DWS did not properly execute the random moment time study (RMTS) as developed and approved for the implementation of its cost allocation plan (CAP).We noted the following errors during the first quarter allocation:a. Payroll costs for 42 employees, or 4.6 percent of pool employees, were included in the wrong RMTS allocation pool.b. Payroll costs totaling $108,176 for 8 of the 42 employees should have been charged as federal direct costs, rather than allocated through the CAP, but were improperly included in the RMTS pool and allocated to various programs. We have questioned these costs.c. Payroll costs for 12 employees, or 1.3 percent of pool employees, were inappropriately included in taking the RMTS survey.d. Twelve employees, or 1.3 percent of pool employees, were inappropriately excluded from taking the RMTS survey.e. Nine of 40 allocated payroll sample items were not subjected to review to ensure proper coding and inclusion/exclusion of allocated payroll costs.We noted the following errors during the fourth quarter allocation:a. From a sample of 60 RMTS surveys, one survey was inappropriately coded according to the DWS?s CAP?an error rate of 1.67 percent. The survey result should have been excluded by internal control reviews. The internal control designed for this area reviews 100 percent of the surveys; however, the error remained undetected and resulted in skewed allocation rates.b. Payroll costs for 26 employees, or 2.8 percent of pool employees, were included in the wrong RMTS allocation pool. Although internal controls detected the errors, the payroll costs were coded to the incorrect pool.DWS?s federally approved CAP indicates the intended goal of the RMTS is to provide a simple, efficient, and precise methodology to appropriately identify, pool, and allocate costs to programs/activities that benefit from them within the requirements of Uniform Guidance. It also outlines the proper inclusion of allocable costs and execution of its RMTS to determine appropriate allocation percentages. Internal controls designed to prevent or detect and correct CAP implementation errors did not function as designed because of inadequate monitoring and supervision by division management.The incorrect inclusion and exclusion of costs to be allocated in the pool, compounded with disproportionate allocation percentages from the RMTS, can cause various federal programs to be inaccurately charged for DWS costs.Recommendation:We recommend DWS division management perform adequate monitoring of CAP internal controls and supervision of staff to ensure the CAP is implemented as designed and approved.DWS?s Response:The random moment time study errors cited by the auditors for the first quarter allocation (July 1, 2019 ? September 30, 2019) occurred prior to the corrective actions taken by the department for prior year finding 2019-027 which were fully implemented by December 31, 2019. The audit results for the fourth quarter allocation demonstrate the department?s substantial improvement in correcting the errors cited by the auditors. The department acknowledges that there was a slight delay in changing the payroll coding for the 26 employees cited by the auditors in part b of the finding for the fourth quarter allocation. The personnel costs for these employees were coded using one program code for a short time at the beginning of the quarter when they technically should have been coded instead to a different program code. However, all personnel costs recorded on the State?s general ledger system for both program codes are captured in the same cost center and are allocated based on the results of the random moment time study. Therefore, there was no effect on the allocation of costs due to the delay in changing the coding.

UNTIMELY ENROLLMENT REPORTING (Dixie State University) CFDA Numbers and Titles: 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans 84.038 Federal Perkins Loan Program Federal Award Number: Various Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A Dixie State University (University) did not ensure that enrollment status changes were reported to the National Student Loan Data System (NSLDS), via a third party servicer, in a timely manner for 4 of the 25 students sampled. The delays ranged from 21?28 days late. According to the NSLDS Enrollment Reporting Guide, the University must report attendance changes within 30 days of determination unless a roster will be submitted within 60 days. The University?s current process does not fully capture the enrollment information for students who have withdrawn or graduated. Untimely reporting of enrollment status could cause inappropriate delays in converting student loans to repayment status, could affect the protection of a student?s interest subsidy, and may result in the distribution of incorrect student data. Recommendation: We recommend the University correct its current process to fully capture student enrollment information and properly report this information to NSLDS in a timely manner. University?s Response: We agree.

UNTIMELY LOAN DISBURSEMENT NOTIFICATION (Dixie State University) CFDA Number and Title: 84.268 Federal Direct Student Loans Federal Award Number: Various Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The University?s Financial Aid Office failed to send disbursement notices within the required timeframe for all Spring 2019 semester direct student loan disbursements. Federal regulations (34 CFR 668.165) require disbursement notices to be sent to the student no earlier than 30 days before and no later than 30 days after crediting the student's account at the institution. The Financial Aid Office was not notified when the Information Technology Department made updates to the systems involved in generating the notices. Consequently, the Financial Aid Office did not perform testing after the update to ensure the systems would properly generate the required notifications. Not sending the appropriate disbursement notifications resulted in the University being noncompliant with federal regulations for all Federal Direct Student Loans disbursed in Spring 2019. Recommendation: We recommend the University perform testing to ensure the systems used to generate loan disbursement notices properly generate and send notices within the required timeframe. University?s Response: We agree.

ERRORS IN PROCESSING RETURN OF TITLE IV FUNDS (Salt Lake Community College) CFDA Numbers and Titles: 84.007 Federal Supplemental Educational Opportunity Grants 84.033 Federal Work-Study Program 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans Federal Award Numbers: Various Questioned Costs: $309 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A Salt Lake Community College (College) has not established a consistent or formal method to verify the processing of return of Title IV funds. As a result, the College did not correctly process the return of Title IV funds for 2 of 25 student records examined, as follows: ? The College incorrectly excluded a student?s subsidized direct loan amounts from the calculation of return of Title IV funds. This error resulted in the College returning $309 fewer Title IV funds than should have been returned. We have questioned these costs. ? The College did not return the amount earned by a student within the required 45-day timeframe. 2 CFR 200.303(a) requires an entity using federal money to have formal and effective internal controls over compliance requirements. In addition, 34 CFR 668.22(a) and (j) state that the institution is responsible to ensure the timely and accurate calculation and return of Title IV funds. Inadequate controls over processing return of Title IV funds could result in noncompliance with federal requirements. Recommendation: We recommend the College establish a consistent or formal method to verify the timely and accurate processing of return of Title IV funds. College?s Response: SLCC agrees with the finding.

INACCURATE LINE ITEMS IN THE FISAP REPORT (Southern Utah University) CFDA Numbers and Titles: 84.007 Federal Supplemental Educational Opportunity Grants 84.033 Federal Work-Study Program 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans Federal Award Numbers: Various Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2016-011 The 2017-2018 Fiscal Operations Report and Application to Participate (FISAP report) submitted by Southern Utah University included information that either did not agree to supporting documentation or did not have supporting documentation: See Schedule of Findings and Questioned Costs for chart/table According to the FISAP instructions, each institution?s chief executive officer must certify that the data on the report is accurate. Although the report was certified, the University does not have adequate internal control to allow for proper verification of the report?s accuracy. During the report preparation, the University relied on a Common Origination Disbursement (COD) system validation report rather than performing a thorough review. Errors on the FISAP report could potentially affect the amount of aid awarded the University in future years. Recommendation: We recommend the University establish internal controls to verify the accuracy of the FISAP report. University?s Response: We concur that there were several errors on the FISAP report due to input errors, wrong calculations, and other incorrect reporting errors. We acknowledge we have a responsibility to establish internal controls to ensure the accuracy of the FISAP report.

UNTIMELY AND INACCURATE ENROLLMENT REPORTING (Southern Utah University) CFDA Numbers and Titles: 84.007 Federal Supplemental Educational Opportunity Grants 84.033 Federal Work-Study Program 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans 84.038 Federal Perkins Loan Program Federal Award Numbers: Various Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The University does not have sufficient controls to verify that student enrollment changes being submitted, via 3rd party, to the National Student Loan Data System (NSLDS) are accurate, timely, or complete. Due to the insufficient controls, the enrollment status for 12 out of 25 students tested was improperly reported to NSLDS, as follows: ? The University reported the enrollment status of six students between 2 and 213 days after the required time frame of 60 days. ? The enrollment status for eight students was reported inaccurately. According to 34 CFR 682.610 step c and 34 CFR 685.300, institutions are required to ensure accurate, timely (within 60 days), and complete enrollment reporting to NSLDS, even when utilizing a 3rd party servicer. The University was unaware of the requirements and was relying upon the 3rd party servicer to ensure the accuracy and timeliness of the submissions. Noncompliance with enrollment reporting requirements could result in the University?s loss of future grant funding. Recommendation: We recommend the University establish internal controls to ensure student enrollment changes are reported in an accurate and timely manner to NSLDS. University?s Response: We concur with this finding, as it exposed multiple holes in the enrollment reporting process through our third-party provider, which we have already begun addressing.

FAILURE TO DESIGN AND IMPLEMENT INTERNAL CONTROLS OVER ENROLLMENT REPORTING (University of Utah) CFDA Numbers and Titles: 84.038 Federal Perkins Loan Program 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans Federal Award Numbers: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The University of Utah (University) did not design and implement internal controls to prevent or to detect and correct inaccurate and untimely student enrollment status reporting. As a result, we identified 3 instances of noncompliance from a sample of 25 students (a 12 percent error rate) as follows: a. One student was reported as withdrawn although the University determined the student?s status to be graduated. b. One student was reported as attending full-time although the University retroactively determined the status to be half-time. c. One student was reported as attending half-time although the University retroactively determined the status to be withdrawn. The University did not report the change of status of these three students within 60 days. According to 34 CFR 685.309, 34 CFR 682.610, 34 CFR 674.33, and the NSLDS Enrollment Reporting Guide, the University must report relevant enrollment changes within 30 days of determination unless a roster will be submitted within 60 days. Additionally, 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal control that provides reasonable assurance that the non-federal entity is managing the program in compliance with terms and conditions of the federal award. The University?s internal processes for enrollment reporting did not include reviewing graduation status error reports or the reports showing enrollment status changes. Inaccurate and untimely reporting to the NSLDS could cause inappropriate delays in converting student loans to repayment status and could also jeopardize a student?s interest subsidy. Recommendation: We recommend the University design and implement internal controls over changes in student enrollment status. University?s Response: The University agrees with the finding.

UNTIMELY REVIEW AND APPROVAL OF CASH DRAWS (Utah State University) CFDA Numbers and Titles: 84.007 Federal Supplemental Educational Opportunity Grants 84.033 Federal Work-Study Program 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans Federal Award Numbers: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A Utah State University (University) did not perform post-draw reviews and approvals of any financial aid cash draws which occurred during our review period of July 2018 to March 2019. According to 2 CFR 200.303(a), the University should establish and maintain effective internal controls over federal awards that provide reasonable assurance that the University is in compliance with federal statutes. The University has established a policy that post-draw reviews be performed timely; however, employee turnover and lack of understanding the importance of this control resulted in the control failures. If cash draws are not reviewed in a timely manner, improper draws, questioned costs, or interest liabilities to the University could occur. Recommendation: We recommend the University review and approve draws timely in accordance with its policies. University?s Response: We agree with the finding.

UNTIMELY AND INCOMPLETE VALIDATION OF PROVIDER ELIGIBILITY (Utah Department of Health) CFDA Number and Title: 93.778 Medical Assistance Program (Medicaid Title XIX) Federal Award Numbers: Various Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A We sampled 40 providers to determine if the Department of Health (DOH) had properly determined eligibility for the Medicaid program. We noted the following errors related to two of the providers tested: a. DOH did not revalidate one provider until three years after the required date. Federal regulations (42 CFR 455.414) require state Medicaid agencies to revalidate the enrollment of all providers at least every 5 years or terminate the enrollment. 42 CFR 455.416(d) allows state agency management to override a termination if it is not in the best interest of the Medicaid program, but provides no timeline for revalidating the provider after an extended enrollment. DOH enacted policies in 2018 to better document management overrides and only allow extensions up to 90 days. However, this particular override occurred before the new policies were put into place, and DOH did not adequately follow up on the override. This provider was properly revalidated in May 2019. Lack of timely follow-up on providers who have received an extension in revalidating could lead to the Medicaid Program paying providers who do not meet all of the requirements stipulated for receiving Medicaid funds. We did not question costs associated with this provider because the override in this situation was allowed by federal regulations. b. For one provider, DOH did not have a signed provider agreement on file as required by 42 CFR 431.107. This error was due to the caseworker?s oversight. Without a signed provider agreement on file, DOH cannot ensure that providers meet all eligibility requirements and have made the necessary disclosures, including certification that they have not been suspended or debarred. DOH subsequently received a signed provider agreement from this provider. Also, this provider was enrolled and eligible for the Medicare program, and per 42 CFR.410(c)(1), Medicaid can rely on the Medicare provider screening process. Thus, we did not question costs associated with this provider. Recommendation: We recommend that DOH: a. Follow its standard operating procedures for revalidating which were established in 2018, including for those providers whose revalidation was overridden before those procedures were put into place. b. Ensure that a signed agreement is on file for each provider. DOH?s Response: The Utah Department of Health agrees with this finding.

ERRORS ON PART 4 OF THE CB-496 FINANCIAL REPORT (Utah Department of Human Services) CFDA Number and Title: 93.659 Adoption Assistance Federal Award Numbers: 1801UTADPT, 1901UTADPT Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A During our review of Part 4 of the CB-496 financial report submitted by the Department of Human Services (DHS) for the federal fiscal year ended September 30, 2018, we noted the following errors: a. DHS submitted Part 4 one week after the required due date of October 30th because the program staff did not realize the report was due until after the due date. Untimely submission of reports results in noncompliance with the program requirements. b. DHS incorrectly reported Expenditures of Adoption Savings as follows: ? Line 10, amount spent on post adoption services, was overreported as $508,654 instead of $507,651. ? Line 11, amount spent on children at risk of foster care, was underreported as $309,516 instead of $349,222. The net effect of these errors was an underreporting of expenditures by $38,703. These errors occurred because the staff were unaware of hidden restrictors in their query of the state?s data warehouse while preparing the line items. Not accurately reporting information results in inaccurate and/or incomplete program information being provided to users of the reports. Recommendation: We recommend that DHS establish appropriate internal controls over reporting to ensure that staff responsible for preparing the reports understand the reporting requirements and that supervisors reviewing the reports to ensure they are accurate and submitted timely. DHS?s Response: We agree the federal Part 4 report should be submitted timely and properly reported.

CCDF BENEFIT OVERPAYMENTS DUE TO ELIGIBILITY SYSTEM UPDATES (Utah Department of Workforce Services) CFDA Numbers and Titles: 1) 93.575 Child Care and Development Block Grant 2) 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Award Numbers: 1) G-1901UTCCDD 2) G1701UTCCDF, G1801UTCCDF, G1901UTCCDF, G1901UTCCDM Questioned Costs: $1,518 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A The Department of Workforce Services? (DWS) eligibility system, eRep, incorrectly calculated Child Care benefit payments for 2 of 60 sample cases?a 3.3 percent error rate. The sampled case expenditures totaled $44,789 and were taken from a total population of $68,345,793. We have questioned the overpayments of $60 related to the sample cases and the additional costs of $1,458 paid on behalf of these two clients during fiscal year 2019, totaling $1,518. Federal regulations (45 CFR 98.45) require DWS to establish and periodically revise a sliding fee scale based on income, family size, and other factors to create a range of child care options. Department policy considers income, family size, and participant work hours as factors in determining benefits. DWS implemented code changes in eRep that inadvertently caused the system to use the wrong sliding fee scale to calculate benefits for work training program participants. DWS did not test updates to eRep in its general change management to ensure the system properly integrated the changes. Incorrect calculations of benefit payments can result in benefit overpayments and noncompliance with grant requirements. Recommendation: We recommend DWS test updates to eRep prior to deployment. DWS?s Response: We agree with the finding and recommendation.

CHILD CARE PROVIDER OVERPAYMENTS DUE TO INSUFFICIENT REVIEWS (Utah Department of Workforce Services) CFDA Numbers and Titles: 1) 93.575 Child Care and Development Block Grant 2) 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Award Numbers: 1) G-1901UTCCDD 2) G1701UTCCDF, G1801UTCCDF, G1901UTCCDF, G1901UTCCDM Questioned Costs: $392,682 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A As part of the department?s annual risk assessment, the Director of DWS?s Office of Child Care identified provider subsidy overpayment and provider agreement noncompliance as risks of noncompliance and communicated these risks to the Internal Audit Director. DWS had recently transitioned provider payments from participant benefit cards to direct provider payments. DWS Internal Audit conducted audits of child care providers who received federal benefit subsidy payments between September 2016 and June 2019. Internal Audit identified providers with insufficient participant attendance records to support the subsidy payments, resulting in questioned costs totaling $392,682. Utah Administrative Code (R986-700-706) and DWS?s Payment to Provider Terms and Conditions agreements require providers to ?keep accurate records of subsidized child care payments, and time and attendance? to which DWS ?has the right to investigate?and audit.? Internal Audit determined it was upon DWS?s transition to the direct provider payment process that the authorized providers began failing to maintain accurate time and attendance records or accurately certify attendance records on a monthly basis. Additionally, the Office of Child Care did not adequately obtain, process, and evaluate the voluminous and varied provider records. Inadequate monitoring of provider agreements, including original attendance records and certifications, could cause DWS to incur undetected unallowable costs. Subsequent to the issuance of its reports, Internal Audit determined that DWS had initiated overpayment recovery through its overpayment division. Recommendation: We recommend DWS implement appropriate reviews of provider agreements, including original attendance records, to substantiate federal subsidy payments. DWS?s Response: We agree with the finding and recommendation.

INCONSISTENT COMPENSATION THRESHOLD AND INAPPROPRIATE ALLOCATION (Commission on Criminal and Juvenile Justice, Utah Office for Victims of Crime) CFDA Number and Title: 16.576 Crime Victim Compensation Federal Award Numbers: 2015-VC-GX-0032, 2016-VC-GX-0057, 2017-VC-GX-0019, 2018-V1-GX-0026 Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2018-029 We sampled 40 Crime Victim Compensation (CVC) expenditures and selected 12 additional significant items at the Utah Office for Victims of Crime (UOVC), a division of the Commission on Criminal and Juvenile Justice (CCJJ), and noted the following noncompliance and internal control issues: a. UOVC does not have policies and procedures to ensure it classifies claims and determines appropriate reparation in a consistent manner and maintains supporting documentation for the decisions. Instead, UOVC classifies claims on a case-by-case basis. We noted 2 of the 40 claims tested for which the reparations officer granted an increased award amount without supporting documentation. The two increased awards concerned the difference between aggravated versus non-aggravated assault. Lack of policies and procedures results in inconsistent claim classification which could, in turn, result in exceeding the aggregate amount allowed per crime as stated in Utah Code 63M-7-511.5. Because the reparation paid on these two claims did not exceed the amount related to the proper classification, we have not questioned any costs associated with these claims. b. UOVC improperly documented and recorded $1,140 paid to a secondary victim for lost wages. The lost wages were shown in the Claims Management System (CMS) under the primary victim?s benefits rather than the secondary victim?s benefits. Payments for secondary victims reduce the victim?s maximum award (Utah Code 63M 7 511.5) and could result in the primary victim not receiving compensation for all eligible reimbursements. Because the reparations paid on this claim did not exceed the aggregate amount allowed, we have not questioned any costs associated with the claim. Recommendations: We recommend UOVC: a. Implement policies and procedures to ensure appropriate reparations are applied in a consistent manner and award decisions are adequately documented. b. Ensure any changes to approved benefits, made after the original eligibility determination, are adequately supported and documented. UOVC?s Response: UOVC agrees.

EXPENDITURES NOT MONITORED FOR PERIOD OF PERFORMANCE PURPOSES (Commission on Criminal and Juvenile Justice, Utah Office for Victims of Crime) CFDA Number and Title: 16.576 Crime Victim Compensation Federal Award Numbers: 2015-VC-GX-0032, 2016-VC-GX-0057, 2017-VC-GX-0019, 2018-V1-GX-0026 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2018-032 UOVC does not monitor or verify that expenditures charged to the CVC program occurred during each award?s period of performance. Funding for this program is derived from both state and federal resources, is recorded in one fund code in FINET, and includes multiple federal awards, each of which have a four-year period of performance requirement. UOVC does not charge the majority of CVC expenditures to a specific award and does not perform any allocation after the fact. The 2017 Department of Justice Grants Financial Guide specifically states that for this program there is no financial requirement to identify the source (federal or state) of individual payments to crime victims. However, without an allocation or some other way to identify the expenditures to a specific federal award, we could not perform appropriate audit procedures to determine compliance with period of performance requirements. By not adequately tracking spending for period of performance purposes, UOVC could be spending funds outside the allowable period. Recommendation: We recommend UOVC charge expenditures to specific awards or otherwise identify the source (federal or state) of payments to crime victims or obtain a waiver from the U.S. Department of Justice stating this requirement does not apply to this program. UOVC?s Response: UOVC agrees.

INACCURATE SPECIAL AND PERFORMANCE REPORTS (Commission on Criminal and Juvenile Justice, Utah Office for Victims of Crime) CFDA Number and Title: 16.576 Crime Victim Compensation Federal Award Numbers: 2015-VC-GX-0032, 2016-VC-GX-0057, 2017-VC-GX-0019, 2018-V1-GX-0026 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2018-031 UOVC has not established adequate internal controls over the State Certification Form and the annual performance report. Federal regulations (200 CFR 200.303(a)) state, ?The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? We selected one performance report and one state certification report submitted during state fiscal year 2019 and noted the following internal control issues and inaccuracies: Inaccuracies in the CVC State Certification Form: The State Certification Form is a federal financial report prepared from information in FINET (the State?s accounting system) and from supporting documentation. The following errors in the report indicate that UOVC?s review of this report is not effective in preventing, or detecting and correcting, errors in the report. ? Subrogation Recoveries, Part I Line B2 & Part II Line A7, was overstated by $2,653 ? Restitution Recoveries, Part I Line B3 & Part II Line A8, was overstated by $2,654 ? Fines and Penalties, Part II Line A4, was overstated by $2,650 ? Earned Interest, Part II Line A11, was overstated by $1,560 ? Reserves Carried Over, Part II Line A12, was overstated by $50,474 ? VOCA Grant Funds, Part II Line C, was overstated by $9,811 The amounts reported in this report should agree to FINET since FINET contains the accounting records that support the audited financial statements and the Schedule of Expenditures of Federal Awards. These errors were caused by inaccurate calculations by UOVC personnel that prepared the report. Inaccuracies in the State Certification Form can impact future program awards. Inaccuracies in the Performance Report The ?Victims of Crime Act Compensation Grant Program State Performance Report? (Performance Report) is an annual report derived from information in UOVC?s Claims Management System. UOVC does not have sufficient controls to ensure the report is submitted with accurate data. We reviewed random line items in the report and noted the following errors: ? The amounts paid for each ?crime type? were incorrectly reported on the Performance Report. Because FINET is not configured to track compensation payments by individual crime type, UOVC uses the amounts from the Claims Management System on the Performance Report. When the total amount paid for all crimes on the Performance Report did not match the amount reported in FINET, UOVC arbitrarily reduced the amount reported for the ?Other? category (since it is the largest of the categories) by $6,156 so the total matched the amount reported in FINET. ? The required performance measurements that went into effect October 2015, e.g., dollar amount of expenses paid by category and type of crime, are not tracked. UOVC has a 2015 correspondence from the Department of Justice stating that these items can be reported as ?not tracked.? The correspondence also stated that UOVC should comply as quickly as possible to start tracking the required measurements but did not give an implementation deadline. As of June 2019, these required performance measures are still being reported as ?not tracked.? In addition to the ?not tracked? performance measures, many of the reporting errors noted below resulted from the Claims Management System not being properly programmed to produce the required information for the Performance Report. ? UOVC?s Claims Management System contains different age ranges for 4 of 6 age categories required on the Performance Report. As such, we were unable to calculate the correct number of applicants within the age ranges requested on the Performance Report. The Claims Management System is not properly programmed to generate reports for the proper age categories. ? The ?Number of applications denied/closed? during the reporting period was understated by 7 applications due to inaccurate input in the report. UOVC understated the number of applications denied/closed for ?incomplete information? by 4 and understated the number of applications denied/closed for ?other? reasons by 3. UOVC should take greater care when entering data into the Claims Management System and preparing the Performance Report. Without tracking or properly generating the required performance measures, UOVC cannot provide the Department of Justice with the critical information needed to know how this program is being administered to help victims of various crimes. Recommendations: We recommend UOVC: ? Implement internal controls to ensure the required reports are prepared in an accurate manner. Such a control would typically include training for UOVC staff and a review by an individual other than the preparer. ? Implement internal controls to ensure the Claims Management System is programmed to accurately capture all data elements required for the Victims of Crime Act Compensation Grant Program State Performance Report. UOVC?s Response: UOVC agrees.

ERRORS IN AND INADEQUATE INTERNAL CONTROLS OVER REPORTING AND EARMARKING (Commission on Criminal and Juvenile Justice, Utah Office for Victims of Crime) CFDA Number and Title: 16.575 Crime Victim Assistance Federal Award Numbers: 2015-VA-GX-0063, 2016-VA-GX-0052, 2017-VA-GX-0057, 2018-V2-GX-0051 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Numbers: 2018-025 UOVC has not established internal controls over the Crime Victim Assistance (CVA) program?s financial and performance reports and administrative expenditure earmarking requirements. Federal regulations (200 CFR 200.303(a)) state, ?The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? We selected three financial reports and one performance report submitted during state fiscal year 2019 and noted the following deficiencies in the submitted reports. Errors in Federal Financial Reports (SF-425) The financial reports were prepared using information generated by UOVC?s internally developed Grant Management System (GMS) which did not agree to information recorded in FINET. While UOVC indicated that the GMS is reconciled to FINET on a monthly basis, we identified the following inaccuracies as we traced the reported amounts to FINET: ? The Federal Share of Expenditures (line 10.e) reported on the 2015 Award?s September 30, 2018 quarterly report was understated by $3,558. ? The Federal Share of Expenditures (line 10.e) reported on the 2016 Award?s December 31, 2018 quarterly report was understated by $949,514, mainly due to the report excluding expenditures for December 2018. The amounts on the federal financial reports should agree to FINET since FINET contains the accounting records that support the audited financial statements and the Schedule of Expenditures of Federal Awards. These errors occurred because of calculation errors and because UOVC does not use expenditures recorded in FINET to prepare the reports. This practice could permit improper amounts to be reported on the SF-425 without detection, which could potentially affect future program funding. Subrecipient-Reported Information Not Adequately Verified UOVC does not perform procedures to verify the earmarking information reported on the U.S. Department of Justice, Office for Victims of Crimes Annual Performance Measurement Tool (PMT) Report. This information is used to ensure the requirements are met related to the 30 percent minimum earmarking for priority categories of crime victims and the 10 percent minimum earmarking for previously underserved victims of violent crimes. As part of its monitoring procedures, UOVC selects one of a subrecipient?s reimbursement requests, obtains supporting documentation for the reported amounts, including earmarking amounts, and performs a desk audit to determine the validity of the numbers reported. These desk audits focus on a single reimbursement request by a subrecipient and do not determine the validity of all amounts reported. Because UOVC does not obtain and review supporting documentation for all necessary data elements, we were unable to determine whether UOVC actually met the 30 percent priority category and 10 percent previously underserved earmarking requirements. All information submitted on the Annual PMT Report should be verified either by obtaining and reconciling supporting documentation to the reported amounts or by performing other procedures to validate the accuracy of the reported amounts and other performance measures submitted by the subrecipients. Inaccurate information on the Annual PMT Report, whether provided to UOVC by the subrecipients or reported by UOVC, could permit program purposes and performance measures to be overlooked or ignored without detection and could potentially affect future program funding. Recommendations: We recommend UOVC: ? Establish internal controls over the preparation of financial and performance reports, which could include a review by an individual other than the preparer. ? Prepare the financial and performance reports using expenditures recorded in FINET to ensure the accuracy in accordance with applicable reporting instructions. ? Establish procedures to verify all amounts reported by UOVC on the Annual PMT Report, particularly those amounts related to earmarking requirements. UOVC?s Response: UOVC agrees.

ON-SITE VISITS NOT PERFORMED BI-ANNUALLY (Commission on Criminal and Juvenile Justice, Utah Office for Victims of Crime) CFDA Number and Title: 16.575 Crime Victim Assistance Federal Award Numbers: 2015-VA-GX-0063, 2016-VA-GX-0052, 2017-VA-GX-0057 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Numbers: 2018-026 UOVC has not performed bi-annual on-site visits to its subrecipients. Because UOVC is required to perform on-site visits once every two years, we reviewed UOVC?s monitoring efforts for the 2015-2017 federal fiscal awards. For all 20 subrecipients in our sample (a 100% error rate), UOVC did not perform and document an on-site visit during the last two years. Federal regulations (28 CFR 94.106(b)) require state administering agencies to conduct on-site monitoring of all subrecipients at least once every two years. However, UOVC?s Monitoring Policies and Procedures state that on-site visits should be conducted ?as staffing allows? and do not specify a time period. UOVC should ensure its written Monitoring Policies and Procedures are in line with the federal regulations. Also, UOVC should maintain a copy of site visit results to document its compliance. Inadequate monitoring of subrecipients could result in noncompliance with grant requirements. Recommendation: We recommend UOVC revise its procedures to ensure it properly performs and documents its on-site visits to subrecipients in accordance with 28 CFR 106(b). UOVC?s Response: UOVC agrees.

INCONSISTENCY AND CALCULATION ERRORS IN FEDERAL CASH DRAWS (Commission on Criminal and Juvenile Justice, Utah Office for Victims of Crime) CFDA Number and Title: 16.575 Crime Victim Assistance Federal Award Numbers: 2015-VA-GX-0063, 2016-VA-GX-0052, 2017-VA-GX-0057 Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Numbers: 2018-027 UOVC lacks procedures to ensure that cash draws are made in a consistent manner. As a result, 4 (50%) of the 8 cash draw requests tested included errors that had a net effect of $34,282 being underdrawn for the CVA program. UOVC should develop effective internal controls over cash management by establishing and following procedures to ensure cash draws capture all expenditures recorded in FINET up to the draw date and are properly calculated. Drawing funds on an inconsistent basis can result in noncompliance with federal cash management requirements and possible lost interest for the State. Recommendation: We recommend UOVC establish procedures to ensure cash draws are made in a consistent manner, including: ? Capturing all expenditures recorded in FINET up to the draw date. ? Properly calculating draw requests. UOVC?s Response: UOVC agrees.

CHECKS ISSUED TO INCORRECT VENDORS (Commission on Criminal and Juvenile Justice, Utah Office for Victims of Crime) CFDA Number and Title: 16.575 Crime Victim Assistance Federal Award Numbers: 2016-VA-GX-0052 Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A UOVC disbursed four CVA program checks totaling $42,286 to incorrect vendors. These checks were subsequently cancelled and the payments sent to the correct vendor; therefore, we have not questioned any costs. Before cash disbursements are approved and distributed, a financial manager should review the transactions to ensure they are the proper amounts, allowable, and match supporting documentation. These errors occurred during UOVC?s transition to a grants management sub system that interfaces with FINET; an office specialist entered incorrect vendor numbers and financial managers failed to perform adequate reviews. Inadequate internal controls over cash disbursements could result in questioned costs and noncompliance with grant requirements. Recommendations: We recommend UOVC: ? Ensure vendor information in the UOVC grants management system is correct. ? Strengthen its review process over disbursements. UOVC?s Response: UOVC agrees.

WORK HOURS AND EARNINGS DISREGARDED IN UNEMPLOYMENT INSURANCE BENEFIT OVERPAYMENT DETERMINATION (Utah Department of Workforce Services) CFDA Number and Title: 17.225 Unemployment Insurance Federal Award Number: UI-32629-19-55-A-49 Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A For 1 of 60 potential overpayments tested, DWS did not properly consider claimant work hours and earnings when determining whether Unemployment Insurance benefits were overpaid. Federal regulations defer overpayment identification to state policies and procedures, which dictate that DWS personnel consider all claimant work hours and earnings as part of the benefit overpayment determination. DWS personnel did not follow procedures or perform mitigating quality reviews to sufficiently prevent or detect and correct the errors. Failure to properly determine benefit overpayments results in misuse of program funds and overpayment penalties not being assessed. Recommendation: We recommend DWS: ? ensure personnel follow established policies and procedures, and ? strengthen mitigating quality reviews of benefit overpayment determination. DWS?s Response: We agree with the finding and recommendation.

INACCURATE STATE HOME REPORT AND STATEMENT OF FEDERAL AID CLAIMED (Utah Department of Veterans and Military Affairs) CFDA Number and Title: 64.015 Veterans State Nursing Home Care Federal Award Numbers: UT660DV, UT6602, UT6603, UT6604 Questioned Costs: $0 Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A We tested eight State Home Report and Statement of Federal Aid Claimed reports (VA Form 10-5588) prepared by the nursing homes overseen by the Utah Department of Veterans and Military Affairs (UDVMA). Four of the eight reports tested had inaccurate amounts on several line items as follows: ? Line 22C, Direct and Indirect Cost, and 22D, Daily Cost of Care for the Month: Incorrect indirect costs were used on all four reports, and incorrect direct costs were used on two of the reports. Per the form instructions, Line 22D is calculated using the amounts in line 22C; thus, the four reports with errors on line 22C also contained errors on Line 22D. The errors ranged from an understatement of $16,135 to an overstatement of $3,791. ? Line 22B, Average Daily Census: An error was noted in the Average Daily Census value for one submitted report. The value was adjusted on several lines of the report and the report was resubmitted; however, this value was not correctly adjusted on Line 22B. As a result, the value reported on Line 22B was incorrect by one person. ? Line 17B, Total Non-Eligible Veterans and Civilian Residents Remaining at the End of the Month: The value on Line 17B of two reports tested did not match the resident rosters and was incorrectly reported by one resident on one report and two residents on the other report. ? Line 20B, Total Days of Care Furnished to Non-eligible Veterans and Civilians: The value on Line 20B of one report tested did not match the resident rosters and was incorrectly reported by 24 days. ? Line 19B, Female Veterans Residents Remaining at the End of the Month: The value on Line 19B of one of the reports tested did not match the resident rosters and was incorrect by one resident. The UDVMA should develop a sound methodology for use by the nursing homes in preparing VA Form 10-5588 to ensure that all information presented on the form matches the supporting documents. The errors above occurred due to improper design and implementation of controls and a lack of understanding by the various nursing homes on how to complete the forms. These type of errors can result in questioned costs and loss of future federal funding. Because the errors noted did not change the amount that UDVMA requested for reimbursement, we have not questioned any costs. Recommendations: We recommend the UDVMA: ? Adopt a formal methodology for calculating direct and indirect costs that adheres to the VA Form 10 5588 instructions. ? Ensure that all UDVMA nursing homes receive training on completing the VA Form 10 5588 using the adopted methodology. ? Develop and put into place stronger controls for identifying reporting errors. UDVMA?s Response: UDVMA agrees with the finding. As stated in the finding, errors noted did not change the dollar amount that the UDVMA requested from the VA for reimbursement.

WORKING CAPITAL RESERVES IN EXCESS OF FEDERAL GUIDELINES (Department of Administrative Services) CFDA Numbers and Titles: Various Federal Award Numbers: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2018-033 As of June 30, 2019, two funds within the Department of Administrative Services held working capital reserves in excess of federal guidelines as follows: See Schedule of Findings and Questioned Costs for chart/table. 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes in each internal service fund. It is inherently difficult to accurately estimate expenses and their effect on working capital reserves when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend that the Department of Administrative Services reduce excess working capital reserves within each of the respective funds or obtain a waiver from the federal cost negotiator allowing for an increase in the number of days of working capital allowed to comply with federal guidelines. Department of Administrative Services? Response: The Department of Administrative Services concurs with the findings.

WORKING CAPITAL RESERVES IN EXCESS OF FEDERAL GUIDELINES (Department of Human Resource Management) CFDA Numbers and Titles: Various Federal Award Numbers: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2018-034 As of June 30, 2019, the Department of Human Resource Management held working capital reserves in excess of federal guidelines as follows: Service Area Level ? Payroll Field Services Excess # of Days in Reserve ? 34 Excess Amount in Reserve ? $57,708 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes in each internal service fund. It is inherently difficult to accurately estimate expenses and their effect on working capital reserves when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend that the Department of Human Resource Management reduce excess working capital reserves for its Payroll Field Services service area level or obtain a waiver from the federal cost negotiator allowing for an increase in the number of days of working capital allowed to comply with federal guidelines. DHRM?s Response: The Department of Human Resource Management (DHRM) agrees with the finding. DHRM is aware that the working capital reserves held in retained earnings exceeded the allowable 60 days of cash expenses on June 30, 2019 at the fund level due to excess reserves in Payroll Field Services.

WORKING CAPITAL RESERVES IN EXCESS OF FEDERAL GUIDELINES (Department of Technology Services) CFDA Numbers and Titles: Various Federal Award Numbers: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2018-035 As of June 30, 2019, the Department of Technology Services held working capital reserves in excess of federal guidelines as follows: Service Area Level ? Hosting Services Excess # of Days in Reserve ? 59 Excess Amount in Reserve ? $2,581,609 2 CFR part 200, Appendix V, paragraph G.2, generally allows a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes in each internal service fund. However, based on federal cost negotiator guidelines, the Department?s reserves are currently calculated at the service area level with a maximum allowed 45 days of reserves. It is inherently difficult to accurately estimate expenses and their effect on working capital reserves when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend the Department of Technology Services reduce excess working capital reserves for its Hosting Services service area level or obtain a waiver from the federal cost negotiator allowing for an increase in the number of days of working capital allowed to comply with federal guidelines. Department?s Response: We agree with the findings from the State Auditor?s Office.

WORKING CAPITAL RESERVES IN EXCESS OF FEDERAL GUIDELINES (Public Employees Health Program) CFDA Numbers and Titles: Various Federal Award Numbers: Various Questioned Costs: Undeterminable Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: 2018-036 As of June 30, 2019, the Public Employees Health Program (PEHP) held working capital reserves in excess of federal guidelines as follows: See Schedule of Findings and Questioned Costs for chart/table 2 CFR part 200, Appendix V, paragraph G.2, generally allows for a working capital reserve as part of retained earnings of up to 60 days cash expenses for normal operating purposes. It is inherently difficult to accurately estimate expenses and their effect on working capital reserves when setting rates. Excess reserves could result in a federal liability since federal programs share an interest in the reserves. Recommendation: Depending on the business requirements, we recommend that PEHP reduce excess working capital reserves or obtain a waiver from the federal cost negotiator allowing for an increase in the number of days of working capital allowed to comply with federal guidelines. PEHP?s Response: PEHP agrees that reserves are in excess of the federally allowed guidelines.

ERRORS IN RANDOM MOMENT TIME STRIKE (RMTS) STUDY (Utah Department of Workforce Services) CFDA Numbers and Titles: Various Federal Award Numbers: Various Questioned Costs: N/A Pass-through Entity: N/A Prior Year Single Audit Report Finding Number: N/A DWS did not properly execute the random moment time study (RMTS) as developed and approved for its cost allocation plan. As a result, the following errors occurred in fiscal year 2019?s first quarter: a. Payroll costs for 18 employees, or 1.9% of pool employees, were inappropriately included in the RMTS pool to be allocated. b. Payroll costs for 2 employees, or 0.21% of pool employees, were inappropriately excluded from the RMTS pool to be allocated. c. Four employees, or 0.42% of pool employees, were inappropriately excluded from taking the RMTS survey. DWS?s federally-approved cost allocation plan indicates the intended goal of the RMTS is to provide a simple, efficient, and reasonable methodology to appropriately allocate costs to the programs/activities that benefit from the costs within the requirements of Uniform Guidance. DWS?s plan outlines the proper inclusion of employee RMTS surveys to determine appropriate allocation percentages. Improper RMTS and payroll coding resulting from employee turnover and employee misunderstanding of job duties caused these errors to occur. The incorrect inclusion and exclusion of costs to be allocated in the pool, compounded with disproportionate allocation percentages from the RMTS, could result in unallowable costs charged to federal programs. Recommendation: We recommend DWS: ? ensure its internal controls operate as designed to prevent, or to detect and correct, RMTS and payroll coding errors; ? maintain the integrity of its internal controls with mitigating controls, especially during periods of transition; and ? provide adequate staff training and communication for RMTS policies and procedures. DWS?s Response: We agree with the finding and recommendation.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION