Open Recommendations

We recommend that the State agency work with CMS to determine the allowable amount of the remaining $306,233,377 set-aside because the rates included unallowable costs that could not be quantified. Specifically, the payment rates incorporated non-Medicaid related costs lumped together into activity code with Medicaid related costs. In addition, the sample moments used were not supported

We recommend that the State agency revise its payment rates to comply with Federal requirements.

We recommend that CMS ensure that suppliers have the applicable licenses for the specific competitions in which they are submitting a bid by continuing to work with State licensing boards, as recommended in our previous report.

We recommend that CMS monitor supplier licensure requirements by implementing a system to identify and address potential unlicensed suppliers.

We recommend that the DHS Office of the Chief Financial Officer (OCFO), in coordination with the Office of the Chief Information Officer (OCIO) and Component management, make the necessary improvements to the Department's supporting IT general controls. Specific, more detailed recommendations were provided in individual limited distribution NFRs to DHS and Component management.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to fill needs for technical and resource personnel support to remediate severe control deficiencies or prevent deterioration of the internal control system.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to assess training needs for personnel and aligning skills with roles and responsibilities; and ensuring individuals in key roles with internal control responsibilities possess the appropriate competencies to perform their duties and are held accountable for their internal control responsibilities.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to ensure significant accounting policies and standard operating procedures are formally documented, complete, updated, and revised timely.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to define roles and responsibilities of program and field personnel that provide key financial information, and ensuring those personnel understand and comply with policies.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to establish a structure with central ownership and oversight for internal controls where responsibilities have been delegated to discrete units.

Additional Department-level leadership is required to address the following areas of the control environment at certain components to define succession and contingency plans for key roles involved in internal control over financial reporting to mitigate risks due to employee turnover.

Risk assessments should be enhanced at both the headquarters level by Departmental management, and individual Components annually, and updated during the year as needed including planned changes that could impact the internal control system, such as financial system transitions and implementation of new tools.

Risk assessments should be enhanced at both the headquarters level by Departmental management, and individual Components annually, and updated during the year as needed including processes reliant on information from service organizations, and effectiveness of controls operating at those service organizations.

Risk assessments should be enhanced at both the headquarters level by Departmental management, and individual Components annually, and updated during the year as needed including processes and controls in which management relies on system generated or manually prepared reports to respond to risk of incomplete or inaccurate information within those reports.

Risk assessments should be enhanced at both the headquarters level by Departmental management, and individual Components annually, and updated during the year as needed including financial accounts and transactions that are susceptible to error due to IT systems functionality issues and inability to rely on application controls supported by IT general controls that are deficient. Refer to Comment I-A, Information Technology Controls and Financial System Functionality.

We recommend that DHS develop continuous monitoring and testing of IT general controls to identify weaknesses, assess the resulting risks created by any identified IT deficiencies, and respond to those risks through implementing compensating controls.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure coordination between headquarters and Components with resource constraints to respond to financial accounting and reporting risks and control deficiencies.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure the structure, process, and communication between key stakeholders is sufficient to ensure there is a complete understanding of the end-to-end flow of transactions for key business processes that impact financial reporting.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure individuals within the financial reporting, accounting and budget departments identify and use quality information for financial reporting.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure roles and responsibilities of program and field personnel that provide key financial information are communicated, and that those personnel understand and comply with policies.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure individuals with key internal control responsibilities have a sufficient understanding of the implication of IT vulnerabilities and limitations,and manual compensating internal controls are designed and implemented to mitigate risk.

Communications within Components, between headquarters and Components, and between financial and IT management, should be improved to ensure monitoring across larger Components with decentralized operations to ensure responsibilities have been properly assigned and clearly communicated, and that internal control over financial reporting and compliance with direct and material laws and regulations have been properly designed and implemented and are operating effectively across the organization.

We recommend that DHS design continuous monitoring controls to ensure personnel with internal control oversight responsibilities adequately examine transactions with a higher risk of error.