REPORT DIGEST

DEPARTMENT OF HEALTHCARE AND FAMILY
SERVICES

FINANCIAL AUDIT
FOR THE YEAR ENDED JUNE 30, 2022

Release Date:  August 15, 2023

FINDINGS THIS AUDIT: 9

CATEGORY:  NEW -- REPEAT -- TOTAL
Category 1:  3 -- 5 -- 8
Category 2:  0 -- 1 -- 1
Category 3:  0 -- 0 -- 0
TOTAL:  3 -- 6 -- 9

FINDINGS LAST AUDIT: 8

Category 1: Findings that are material
weaknesses in internal control and/or a
qualification on compliance with State
laws and regulations (material
noncompliance).
Category 2: Findings that are
significant deficiencies in internal
control and noncompliance with State
laws and regulations.
Category 3: Findings that have no
internal control issues but are in
noncompliance with State laws and
regulations.

State of Illinois, Office of the
Auditor General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, Iles
Park Plaza, 740 E. Ash Street,
Springfield, IL 62703
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are
also available on the worldwide web at
www.auditor.illinois.gov


SYNOPSIS

• (22-01) The Departments (HFS and DHS)
had weaknesses in the general
information technology (IT) controls
over the Integrated Eligibility System
(IES).
• (22-07)  The Department’s year-end
financial reporting in accordance with
generally accepted accounting
principles (GAAP) contained weaknesses
and inaccuracies.
• (22-08) The Department did not have
adequate internal controls to ensure
all eligible expenditures initiated by
other State agencies were included in
its Medicaid federal financial
participation (FFP) reimbursement
claims.

FINDINGS, CONCLUSIONS, AND
RECOMMENDATIONS

INADEQUATE GENERAL INFORMATION
TECHNOLOGY (IT) CONTROLS OVER IES

The Department of Healthcare and Family
Services and the Department of Human
Services (collectively, the
“Departments”) had weaknesses in the
general information technology (IT)
controls over the Integrated
Eligibility Systems (IES).

Management of the Departments have a
shared responsibility for various human
service programs in the State and for
internal controls over the manual and
automated processes relating to
eligibility for these programs.  The
Departments’ IES is the automated
system used by the Departments to
intake, process (with the assistance of
caseworkers), and approve assistance
applications, maintenance items, and
redeterminations of eligibility as well
as to make payments for the State’s
human service programs.

In addition to the conditions noted
below, related IES issues over the lack
of a detailed interagency agreement are
noted in Finding 2022-009, and issues
over disaster recovery controls are
noted in Finding 2022-002.

Environment

The IES application and data reside on
the Department of Innovation and
Technology (DoIT) environment.  In this
regard, DoIT is a service provider (SP)
to the Department.

During the Departments’ internal
security review, completed as part of
its Plan of Actions and Milestones
(2022) report to the U.S. Department of
Health and Human Services, Centers for
Medicare and Medicaid Services (Federal
CMS), significant threats over DoIT’s
general IT environment, which hosts
IES, were identified.

Further, during our fieldwork it was
noted the Departments experienced two
security breaches related to the IES
system; the first breach occurred in
August 2022, and the second breach was
discovered in March 2023.  Information
about both breaches is disclosed in the
notes to the financial statements as
subsequent events.

Change Control

IES Application Changes - Policies and
Procedures

The Departments indicated there were no
updates to the change control policies
and procedures during fiscal year 2022.
Our review of the April 20, 2020 IES
Change Management Plan (Plan) noted the
Plan did not:
• Define the requirements for the
prioritization or classification of
changes,
• Define the numerical grading for
determining impact,
• Define the detailed documentation
requirements for test scripts and
results, impact analysis, design
documentation, or other required
documentation, and
• Define when changes were required to
include a specific requirement, who was
to review the various steps and when
and by whom approvals were required.

Additionally, we noted backout plans to
return the system to a previous
functional version in the event a
change moved into production caused
undesired results had not been prepared
for individual infrastructure changes.

User Access

IES User Access Policies and Procedures
The Departments indicated there were no
updates to IES user access policies and
procedures during fiscal year 2022.
During our testing of the Departments’
access provisioning policies, we noted
the policies did not define the time-
period in which the Departments were
required to disable a terminated
individual’s system access. Also, there
was no systemic record of the date when
the access was removed, or a
management-defined definition of
timeliness.  Therefore, we were unable
to determine whether user access was
removed timely when a user was
transferred or terminated. (Finding 1,
pages 56-59)

We recommended management of both
Departments work together to strengthen
controls over the IES environment by
addressing all significant threats
identified in the Plan of Actions and
Milestones (2022) report to the U.S.
Department of Health and Human
Services, Centers for Medicare and
Medicaid Services, strengthen controls
in the IES Change Management Plan by
including the items noted above, and
enhance internal control over IES user
access by adopting a formal written
policy or procedure which includes a
definition of "timely" for disabling an
individual's access to the IES system,
and a process for tracking whether
access was revoked timely based on the
definition.

HFS accepted the recommendation and
stated it will work with the DHS and
the DoIT to implement the
recommendation.

FINANCIAL STATEMENT PREPARATION
WEAKNESSES

The Department of Healthcare and Family
Services’ (Department) year-end
financial reporting in accordance with
generally accepted accounting
principles (GAAP) contained
inaccuracies and omitted amounts
affecting balances.

Adjustments to Financial Statements

During our audit of the Department’s
financial statements, we brought errors
to the Department’s attention which
included items such as the following:

• “Accounts payable & accrued
liabilities” in the Public Aid
Recoveries Trust Fund (0421) was
overstated by $6.2 million and “Other
charges for services” was understated
by the same amount.

• Footnote 17, Restatement: The
implementation of GASB Statement No.
87, Leases table originally disclosed
incorrect balances for the lease
obligations line.  The net deficit
amount was originally reported as $422
thousand and should have been $785
thousand.
The Department subsequently corrected
these errors.

Further, the Department lacked
effective communication between its
program and fiscal areas which resulted
in additional errors. These errors were
identified after updated detailed
information was provided to the
financial reporting area, and
additional analysis was performed both
internally and with other affected
State Departments to identify accurate
financial revisions. As a result of the
further analysis subsequently performed
by the Department, management provided
us with multiple revisions to its draft
financial statements which contained
many modifications, with the final
revision provided on July 17, 2023.
Several of the modifications were
individually inconsequential to the
overall fairness of the presentation of
its financial statements. However, the
modifications also included the
following material adjustments:

• “Due from other State funds” in the
Healthcare Provider Relief Fund (0793)
was understated by $4.5 million and
“Federal operating grants” was
understated by the same amount for
Supplemental Nutrition Assistance
Program (SNAP) expenditures paid by
another state agency.

• “Federal operating grants” in the
Healthcare Provider Relief Fund (0793)
was understated by $59.4 million.  “Due
to other government – federal” was
understated by $13.6 million, and “Due
to other State funds” was understated
by $45.8 million.  The Department
subsequently identified these changes
after further analysis of the financial
reporting for the Home and Community
Based Services (HCBS) expenditures and
revenues.

• “Due from other Government - Federal”
in the General Revenue Fund (0001) was
understated by $601 million.  “Federal
operating grants” was understated by
$529 million and the prior period net
position was understated by $72 million
at the government-wide level due to the
Department’s inability to timely submit
a federal reimbursement claim for HCBS
developmental disabilities (DD) waiver
program expenditures paid by another
state agency.  The details regarding
what contributed to this issue are more
fully described in Finding 2022-008
(Insufficient controls over
administration of Medicaid claims).

Timeliness of Disclosures to Auditors

Two of the issues described above were
brought to the attention of the
auditors’ months after the end of the
fiscal year. For the further analysis
of the financial reporting for the Home
and Community Based Services (HCBS)
expenditures and revenues item noted
above, we were provided information in
March 2023 about additional HCBS
receivables for which management became
aware of in December 2022.
Additionally, the under reporting of
reimbursable DD program expenditures
for Medicaid funded waiver programs
described above was not communicated to
auditors until June 2023, despite
management becoming aware of the issue
in January 2023. (Finding 7, pages
73-75)

We recommended the Department
strengthen its internal controls to
ensure its financial reporting is
complete and accurate and in accordance
with GAAP. Additionally, we recommended
Department management promptly disclose
known events, conditions, and
transactions of the Department which
could impact either an ongoing audit or
previously released audit performed by
the Office of the Auditor General, even
if the full ramifications of the matter
are not yet known.

The Department accepted the
recommendation and stated it will
strive to improve financial reporting
preparation and review processes and
will engage in conversations with the
auditors concerning their expectations
relative to when less than fully vetted
issues should be brought to their
attention.

INSUFFICIENT CONTROLS OVER
ADMINISTRATION OF MEDICAID CLAIMS

The Department of Healthcare and Family
Services (Department) did not have
adequate internal controls to ensure
all eligible expenditures initiated by
other State agencies were included in
its Medicaid federal financial
participation (FFP) reimbursement
claims.

On June 12, 2023, nearly one year from
the June 30, 2022, financial statements
date, Department management notified us
that it did not include certain other
agency waiver Medicaid expenditures,
made by the Department of Human
Services (DHS), in its quarterly FFP
claims during the fiscal year ended
June 30, 2022.  The impact of this
issue on the Department’s financial
statements and any associated
adjustments are more fully described in
Finding 2022-007 (Financial statement
preparation weaknesses).

As part of its operational
responsibilities, DHS administers Home
and Community Based Services (HCBS)
developmental disabilities (DD) waiver
programs.  Weekly, DHS sends the
Department, via an automated file
transfer, its DD expenditure
information.  After each automated file
transfer of expenditure data occurs, an
acceptance/rejection report is
generated and automatically sent from
the Department to DHS for them to
review and notify the Department of any
discrepancies.  On a quarterly basis,
the Department also generates a federal
revenue summary report which is
provided to DHS that reflects the funds
it expended on programs for which
Medicaid FFP is claimed.  The summary
report includes the total claimed for
FFP related to DHS expenditures for the
most recent quarter, as well as the
preceding quarters of the fiscal year.
DHS is expected to review the summary
report and notify the Department of any
discrepancies.  The Department, as the
lead agency for the State’s Medicaid
program, submits quarterly FFP claims
to the U.S. Department of Health and
Human Services, Centers for Medicare &
Medicaid Services (Federal CMS) for
reimbursement according to the
applicable Medicaid FFP percentage.

In January 2021, failures in the
automatic transmission of expenditure
data from DHS to the Department began
occurring, resulting in the
Department’s inability to claim FFP for
DD waiver expenditures.  The cause of
the data transfer failure from January
2021 through June 2021 is not known.
Additionally, in July 2021, DHS moved
from its previously used software
platform to the State of Illinois’
Enterprise Resource Planning (ERP)
System.  When the software platform
change was implemented, a programming
error occurred which prevented the
automated file transfer from taking
place.  Because the Department did not
receive the expenditure data, federal
claiming on these DD expenditures did
not occur during the audit period.  The
programing error continued until
January 2023.  Further, because the
Department did not receive the
expenditure information, the
acceptance/rejection and federal
revenue summary reports noted above did
not include such expenditures and DHS
staff did not subsequently identify
they were missing.  The automated file
transfer issue impacted only federal
claiming and had no effect on DHS’
payment to providers.

DD waiver expenditures described herein
are paid from DHS’ appropriations and
reported by DHS, while the revenue from
the FFP reimbursements is deposited and
reported by the Department in the
General Revenue Fund (GRF).  Such
divergence in the reporting of DD
waiver expenditures and resultant
revenues inherently increases the risk
that errors and omissions in claiming
may occur.

As a result of the inadequate internal
controls which led to the missing DHS
expenditure data for which to claim
FFP, DD expenditures were excluded from
the Department’s Federal CMS quarterly
claims for roughly a 24-month period
(substantially all of calendar 2021 and
2022).  For fiscal year 2022, we noted
the Department did not submit
approximately $1.1 billion in DD
expenditures to Federal CMS on its
quarterly claims report until the
quarter ended March 30, 2023.  The FFP
portion of the $1.1 billion in DD
expenditures equated to approximately
$601 million in federal grant revenue
to the State of Illinois which was
delayed in being deposited into the
State Treasury for up to 21 months.
The amount of FFP claimed from
expenditures paid after fiscal year
2022 up until the automated file
transfer error was identified and
resolved was outside the fiscal year
2022 audit period, and therefore, we
did not request such information.

Further, because the Code of Federal
Regulations (45 C.F.R § 95.7) states
the Department can only claim FFP
reimbursement within 2 years after the
calendar quarter in which the
qualifying expenditure has been paid,
the Department was unable to claim FFP
on approximately $80 million of DD
expenditures paid by DHS during the
quarter ended March 31, 2021,
representing approximately $40 million
of federal grant revenue being lost to
the State if not granted an exception
by the federal government. (Finding 8,
pages 76-79)

We recommended the Department implement
adequate internal controls over its
administration of the Medicaid claims
process in order to timely identify any
missing expenditure data with which to
claim FFP for eligible expenditures
initiated by other State agencies.  We
also recommended the Department
coordinate with DHS, and other State
agencies where applicable, to
prospectively explore affecting a
budgeting change whereby the
reimbursement revenue of individual
programs are deposited and reported by
the same agency and within the same
fund to increase oversight thereof.

The Department accepted the
recommendation and stated it will begin
conversations with the Governor’s
Office of Management and Budget and the
Illinois Office of the Comptroller to
explore options for allowing GRF
federal revenue to be reflected in the
financial statements of non-Healthcare
and Family Services agencies
responsible for the administration of
Medicaid services.  The Department also
stated the Department and DHS will
reinforce the use of current internal
controls and pursue a corrective action
plan. Further, regarding the timing of
the Department’s auditor notification,
the Department stated it will engage in
conversations with the auditors
concerning their expectations relative
to when less than fully vetted issues
should be brought to their attention.

OTHER FINDINGS

The remaining findings pertain to
inadequate disaster recovery controls
over the IES, inadequate general
information technology controls over
IMPACT, insufficient review and
documentation of provider enrollment
determinations and failure to timely
execute interagency agreement, failure
to review service providers’ internal
controls, inadequate general
information technology controls, and
detail agreement between DHS, HFS, and
DoIT over IES not finalized. We will
review the Department’s progress
towards the implementation of our
recommendations in our next financial
audit.

AUDITOR’S OPINION

The auditors stated the financial
statements of the Department of
Healthcare and Family Services as of
and for the year ended June 30, 2022
are fairly stated in all material
respects.

This financial audit was performed by
Sikich LLP.

JANE CLARK
Division Director

This report is transmitted in
accordance with Section 3-14 of the
Illinois State Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:jv