Open Recommendations

We recommend that the State agency develop policies and procedures to ensure that it obtains attendance records from providers that are no longer in business.

We recommend that the State agency refund to the Federal Government the estimated $19,076,167 Federal CCDF share of the Child Care Subsidy Program claims paid during SFYs 2014 and 2015.

We recommend the State agency refund $300,452,930 in Federal Medicaid reimbursement claimed based on payment rates that incorporated unallowable costs. This disallowance is based on $220,314,119 calculated by removing allowable costs and RMS study based on correct activity moments plus $80,138,811 which was claimed based on a pending amendments to its State plan. The $220,314,119 includes the effect of including unallowable costs in the rate pool as follows: -Unpaid Pension Costs-$435,287,077 -Unallowable disabilities teacher-consultant salaries $61,528,162 -Special education or non health related services $75,379,253 The rates were recalculated using corrected random moment timestudy activity codes that were changed by the…

We recommend that the State agency work with CMS to determine the allowable amount of the remaining $306,233,377 set-aside because the rates included unallowable costs that could not be quantified. Specifically, the payment rates incorporated non-Medicaid related costs lumped together into activity code with Medicaid related costs. In addition, the sample moments used were not supported

We recommend that the State agency revise its payment rates to comply with Federal requirements.

We recommend that CMS ensure that suppliers have the applicable licenses for the specific competitions in which they are submitting a bid by continuing to work with State licensing boards, as recommended in our previous report.

We recommend that CMS monitor supplier licensure requirements by implementing a system to identify and address potential unlicensed suppliers.

We recommend that the DHS Office of the Chief Financial Officer (OCFO), in coordination with the Office of the Chief Information Officer (OCIO) and Component management, make the necessary improvements to the Department's supporting IT general controls. Specific, more detailed recommendations were provided in individual limited distribution NFRs to DHS and Component management.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to fill needs for technical and resource personnel support to remediate severe control deficiencies or prevent deterioration of the internal control system.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to assess training needs for personnel and aligning skills with roles and responsibilities; and ensuring individuals in key roles with internal control responsibilities possess the appropriate competencies to perform their duties and are held accountable for their internal control responsibilities.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to ensure significant accounting policies and standard operating procedures are formally documented, complete, updated, and revised timely.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to define roles and responsibilities of program and field personnel that provide key financial information, and ensuring those personnel understand and comply with policies.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to establish a structure with central ownership and oversight for internal controls where responsibilities have been delegated to discrete units.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to define succession and contingency plans for key roles involved in internal control over financial reporting to mitigate risks due to employee turnover.

Risk assessments should be enhanced at both the headquarters level by Departmental management, and individual Components annually, and updated during the year as needed including planned changes that could impact the internal control system, such as financial system transitions and implementation of new tools.

Risk assessments should be enhanced at both the headquarters level by Departmental management, and individual Components annually, and updated during the year as needed including processes reliant on information from service organizations, and effectiveness of controls operating at those service organizations.

Risk assessments should be enhanced at both the headquarters level by Departmental management, and individual Components annually, and updated during the year as needed including processes and controls in which management relies on system generated or manually prepared reports to respond to risk of incomplete or inaccurate information within those reports.

Risk assessments should be enhanced at both the headquarters level by Departmental management, and individual Components annually, and updated during the year as needed including financial accounts and transactions that are susceptible to error due to IT systems functionality issues and inability to rely on application controls supported by IT general controls that are deficient. Refer to Comment I-A, Information Technology Controls and Financial System Functionality.

We recommend that DHS develop continuous monitoring and testing of IT general controls to identify weaknesses, assess the resulting risks created by any identified IT deficiencies, and respond to those risks through implementing compensating controls.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure coordination between headquarters and Components with resource constraints to respond to financial accounting and reporting risks and control deficiencies.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure the structure, process, and communication between key stakeholders is sufficient to ensure there is a complete understanding of the end-to-end flow of transactions for key business processes that impact financial reporting.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure individuals within the financial reporting, accounting and budget departments identify and use quality information for financial reporting.