REPORT DIGEST DEPARTMENT OF HUMAN SERVICES FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2018 Release Date: August 22, 2019 FINDINGS THIS AUDIT: 11 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 4 -- 7 -- 11 Category 2: 0 -- 0 -- 0 Category 3: 0 -- 0 -- 0 TOTAL: 4 -- 7 -- 11 FINDINGS LAST AUDIT: 11 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (18-01) The Department does not have an adequate understanding of the internal controls in place over all data recorded in its financial statements and does not sufficiently review transactions initiated by other State agencies and recorded in the Department’s financial statements. • (18-04) The Departments (HFS, DHS, DCFS, and DoA) failed to execute adequate internal controls over the implementation and operation of the State of Illinois’ Illinois-Michigan Program Alliance for Core Technology system (IMPACT). • (18-07) The Departments (DHS and HFS) did not adequately execute internal controls over the implementation and operation of the State of Illinois’ Integrated Eligibility System (IES) Phase II. • (18-09) The Departments (DHS and HFS) did not maintain adequate controls to ensure applications for human service programs were reviewed and approved or denied within the mandated 45 or 30 day timeframes. Additionally, the Departments did not conduct timely redeterminations of eligibility for the Supplemental Nutrition Assistance Program (SNAP), the Temporary Assistance for Needy Families (TANF) Program, and the Medicaid (medical) Program recipients. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS MEDICAL ASSISTANCE PROGRAM FINANCIAL INFORMATION The Department of Human Services (Department) does not have an adequate understanding of the internal controls in place over all data recorded in its financial statements and the Department does not sufficiently review transactions initiated by other State agencies and recorded in the Department’s financial statements. During our testing of the financial statements we noted the following: • The Department could not provide documentation of the preparation or the Department's review of expenditure reconciliations for Federal Medical Assistance Program (MAP) funds (Funds 0120, 0142, 0365, 0502, 0718) between amounts reported in the Department's Consolidated Accounting and Reporting System (CARS) and amounts reported in the Grant/Contract Analysis Forms (Form SCO-563s) provided to the Comptroller's Office (IOC) which support the receivable calculation for financial reporting. The amount per the Form SCO-563s (totaling about $418 million) is a computed amount (a formula), essentially the amount needed to achieve the reported receivable balance provided by the Department of Healthcare and Family Services (HFS), a separate State agency. The Department does not retain a reconciliation between what is reported on the Form SCO-563s (claimable expenditures) and within CARS (all expenditures) for each fund. Additionally, there is no documentation maintained by the Department to support the calculation and methodology used by HFS in preparing the federal receivable amount. • During testing of expenditures and liabilities, we determined that the Department is not monitoring or reviewing the payments submitted by HFS, or the liabilities calculated by HFS, on behalf of the Department and reported in the Department’s financial statements. When HFS submits a request for payment to the IOC, a summary file is also sent to the Department which goes through an interface and is recorded into CARS. An employee in the Department’s Fiscal Services Bureau reconciles the payments between CARS and the IOC before accepting them into CARS. However, the Department has not obtained and documented a detailed understanding of how its transactions are processed within HFS, the controls in place over those transactions, monitoring performed by HFS, exceptions noted by HFS through its monitoring activities, and how exceptions and control deficiencies are addressed by HFS and communicated to the Department. We selected and tested multiple expenditures and liabilities initially processed by HFS. Currently, the Department receives summarized information from HFS and records the transactions into CARS and the GAAP packages without performing sufficient procedures to determine the accuracy of the information. (Finding 1, pages 82-83) We recommended the Department assume more responsibility for the transactions and balances reported in its financial statements that are initiated/estimated by other State agencies, including the following: working with management of HFS to gain a better understanding of the internal control system established over Department transactions, enter into an interagency agreement with HFS that details the responsibilities of each agency and how this will be monitored, and reconcile CARS to expenditure amounts provided by HFS in connection with year-end reporting of Federal MAP receivables. The Department accepted the recommendation and stated it will prepare documentation, at a high level, of HFS’ internal controls over Department transactions and institute annual monitoring. Further, the Department stated it will implement a process to verify that the data provided by HFS is complete and accurate. STATEWIDE FAILURE TO EXECUTE INTERAGENCY AGREEMENTS AND PERFORM ESSENTIAL PROJECT MANAGEMENT FUNCTIONS OVER PROVIDER ENROLLMENT IN THE MEDICAID PROGRAM The Department of Healthcare and Family Services (HFS), the Department of Human Services (DHS), the Department of Children and Family Services (DCFS), and the Department on Aging (DoA) (collectively, the “Departments”) failed to execute adequate internal controls over the implementation and operation of the State of Illinois’ Illinois-Michigan Program Alliance for Core Technology system (IMPACT). Specifically, management of the Departments did not enter into interagency agreements (IA) defining each agency’s roles and responsibilities, and did not perform essential project management functions over the implementation of IMPACT. HFS’ and Delegated Agencies’ Roles As set by the State of Illinois’ State Plan under Title XIX of the Social Security Act (State Plan) (Section 1.1), the State’s designated agency responsible for administering and supervising the administration of the Medicaid Program is HFS. However, Section 1.1 of the State Plan also allows for HFS to delegate specific functions to other State entities to assist with the administration of the Medicaid Program, pursuant to a written IA defining each agency’s roles and responsibilities. During our testing, we identified the following delegated agencies, which we will refer to as HFS’ Delegated Agencies, and examples of the Medicaid services they provide which utilizes IMPACT for enrollment of their providers. DHS administers several human service programs under the Medicaid Program, including developmental disabilities support services, rehabilitation services, and substance abuse (prevention and recovery) services. DCFS administers the State’s child welfare program which includes cooperating in the establishment of Medicaid eligibility for children who are wards of the State. DoA administers the State’s programs for residents aged 60 and older, including Home and Community Based Services to Medicaid recipients who meet Community Care Program requirements. Auditor Testing and Results In order to determine if the Departments complied with federal and State laws, rules, and regulations when they developed, implemented, and operated IMPACT, we reviewed the Departments’ applicable policies and procedures governing IMPACT. The testing identified the following material weaknesses in internal control: • The Departments did not have current, formal written agreements defining the roles and responsibilities of HFS or its Delegated Agencies of the Medicaid Program. • While DHS utilized IMPACT to formally approve providers for the purposes of granting payments of their Medicaid claims, it did not utilize IMPACT as its book of record or rely on it to verify the providers met certain federal requirements. In this instance, the book of record means the mandatory system designated by HFS to be used for the tracking of the State’s activities, events, or decisions when approving or denying the enrollment of Medicaid providers. When we inquired of DHS as to why it did not retain the documentation within IMPACT to support its determination of enrollment, DHS management stated it chose to maintain the supporting documentation outside of IMPACT as it could not rely on IMPACT. • When we inquired of DCFS and DoA as to what their processes were regarding the use of IMPACT, they both stated they did not use IMPACT after formally approving the providers for the purpose of granting payments of their Medicaid claims. They both believed HFS was doing the subsequent review of, and maintenance of, provider enrollment information for them. After asking HFS to confirm if DCFS’ and DoA’s statements were accurate, HFS management stated that was not the case and both DCFS and DoA had the responsibility to subsequently review their providers eligibility for enrollment in the Medicaid program. • The Departments implemented IMPACT despite the inability of IMPACT to allow Illinois officials to generate customary and usual system internal control reports, including such information as provider data, security measures, or updates made to IMPACT. The Departments must go through the third party service provider (TSP) in order to obtain any reports needed by the State. • Based on testing of the documented procedures governing IMPACT, the auditors noted the following: – the procedures only addressed the actions that should have been taken by HFS and did not include the procedures to be followed or taken by the Delegated Agencies, – the procedures contained contradictory provisions, and – the procedures did not depict the actual actions taken by HFS staff during the examination period. • The Departments failed to establish and maintain adequate general information technology controls over IMPACT. • The Departments had inadequate project management over the implementation of IMPACT. According to the Intergovernmental Agreements, Amendments, and Statements of Work signed between HFS and the TSP, who maintains and hosts IMPACT, the TSP was to provide HFS various deliverables throughout the implementation of the project for its timely review and approval. During testing of the deliverables required to be provided, the auditors noted the following: – HFS did not receive 9 of the 60 (15%) required deliverables, – For 39 of the 51 (76%) deliverables received, there was no supporting documentation to demonstrate HFS had approved them, and – One of the 51 (2%) deliverables received, the Provider Enrollment (PE) Implementation Plan, was noted as “draft”. As a result, HFS does not have supporting documentation to show it received and approved the “final” version of the deliverable. The purpose of the PE Implementation Plan was to define the overall approach for the implementation of the PE module of IMPACT. • As a result of inadequate project management, the Departments did not implement adequate security controls over IMPACT. • The Departments did not design and establish an adequate internal control structure over provider enrollment determination such that sufficient and appropriate evidence, maintained in a paperless format, existed to support each provider met various compliance requirements at the time when the Departments determined each provider’s eligibility. Further, management at the Departments failed to adequately monitor manual provider enrollment determinations, as (1) staff did not consistently document their review of the provider applications in accordance with HFS’ Process Checklists and (2) HFS did not establish a system of supervisory reviews of work performed by staff. (Finding 4, pages 90-97) We recommended management of the Departments execute detailed IAs which define the roles and responsibilities of each agency regarding the Medicaid Program. The IAs should sufficiently address necessary procedures to enforce monitoring and accountability provisions over IMPACT as required by the Code of Federal Regulations, the State Plan, and the Act so the enrollment of providers offering services to recipients of the Medicaid program is carried out in an effective, compliant, efficient, and economical manner. We further recommended the Departments obtain and review/approve the remaining deliverables from the TSP and, in the future, the Departments should establish adequate controls over project management for the development and implementation of major projects, such as IMPACT. DHS officials agreed with the recommendation and stated it will work with HFS to execute a detailed intergovernmental agreement which defines the roles and responsibilities of each agency to enforce monitoring and accountability provisions over IMPACT as required. Further, DHS stated it will work with HFS to establish adequate controls over project management for the development and implement of major projects, such as IMPACT. FAILURE TO PERFORM ESSENTIAL PROJECT MANAGEMENT FUNCTIONS OVER THE INTEGRATED ELIGIBILITY SYSTEM (IES) The Department of Healthcare and Family Services (HFS) and the Department of Human Services (DHS) (collectively, the “Departments”) did not adequately execute internal controls over the implementation and operation of the State of Illinois’ Integrated Eligibility System (IES) Phase II. Specifically, management of the Departments did not perform adequate project management functions over the implementation of IES Phase II. IES was developed to consolidate and modernize eligibility functions and to comply with the Affordable Care Act of 2010. Phase II of IES was placed into service on October 25, 2017. In order to determine if the Departments had complied with Federal and State laws, rules, and regulations when the Departments developed, implemented, and operated IES Phase II, we tested the Departments’ applicable policies and procedures governing IES Phase II. Our testing identified the following: • The Departments did not have current, formal written agreements, policies, or procedures defining the roles and responsibilities of HFS, DHS, and DoIT regarding the operation of IES. • During our analysis and review of IES Phase II data, 128 individuals were identified in which each individual's Social Security number had been overwritten when a data update was done after the conversion to IES Phase II. • During our review of the Departments’ User Acceptance Test Plan (Plan) which was used to implement IES Phase II into production, we noted the Plan did not document the Departments’ controls over all aspects of the Departments’ user testing. Specifically, the Plan did not address controls governing the Departments’ Adverse Action Testing and the Requirements Traceability Matrix (RTM) Scripts for Test Scripts for Technology. • The Departments’ review and approval of required contract deliverables for the implementation of IES Phase II were inadequate. • The Departments implemented IES Phase II even though IES Phase II did not take into consideration information being retained by a third party service provider (TSP) that was sending and accepting redetermination paperwork and reporting functions for the State. • DHS waived the requirement for the SNAP December 2017, January 2018, and February 2018 Mid-Point reports (MPRs). • The Departments failed to establish and maintain adequate general information technology controls. Specifically, we noted the Departments did not implement adequate security or change management controls over IES. • The Departments had insufficient review and documentation of recipient eligibility determinations. Additionally, we would like to note that from the Fall of 2018 through the Spring of 2019, we made several requests to the Departments for essential documentation relating to the testing of IES Phase II’s project management, systems development, and contractual requirements in order to assess the risk of material misstatements to Departments’ financial statements. In July 2019, the Departments finally provided sufficient supporting documentation regarding the above in order for us to provide an unmodified opinion. (Finding 7, pages 113-122) We recommended (1) the Departments cooperate fully with FNS and Federal CMS to timely implement all corrective actions necessary to alleviate the potential for future acts of material noncompliance, (2) the Departments execute written agreements, policies, and procedures defining the roles and responsibilities of HFS, DHS, and DoIT regarding the operation of IES for each of the applicable human service programs, (3) the Departments should obtain, review, and approve the remaining deliverables from the development vendor and, in the future, the Departments should take action to establish adequate controls over project management for the development and implementation of major projects, such as IES, and (4) the Departments should provide accurate and timely responses to auditor requests. DHS accepted the recommendation and stated it defers to HFS for any oversight to the Corrective Action Plan with the Federal CMS mentioned in the audit report. Further, DHS stated it will (1) continue to work with FNS in the efficient and effective administration of the Supplemental Nutrition Assistance Program, (2) work to execute written agreements, policies, and procedures defining the operational roles and responsibilities of HFS, DHS, and DoIT staff regarding the operation of IES for each of the applicable human service programs, (3) create Corrective Action Plans to address each deficiency, and (4) continue to work cooperatively to respond accurately and timely to auditor requests. BACKLOG OF APPLICATIONS AND REDETERMINATIONS FOR HUMAN SERVICE PROGRAMS The Department of Healthcare and Family Services (HFS) and the Department of Human Services (DHS) (collectively, the “Departments”) did not maintain adequate controls to ensure applications for human service programs were reviewed and approved or denied within the mandated 45 or 30 day timeframes. Additionally, the Departments did not conduct timely redeterminations of eligibility for the Supplemental Nutrition Assistance Program (SNAP) and the Temporary Assistance for Needy Families (TANF) Program, and the Medicaid (medical) Program recipients. The Departments’ Integrated Eligibility System (IES) is the automated system used by the Departments which intakes, processes (with the assistance of caseworkers), and approves recipient applications, maintenance items, and redeterminations in order to determine eligibility and make payments for the State’s human service programs. As part of our audit procedures, we tested the Departments’ compliance with the federal time requirements for approving or denying applications, conducting redeterminations, and working any changes communicated by recipients for the SNAP, the TANF, and the medical programs. • For initial applications – The Departments provided us information indicating that as of June 30, 2018, the Departments had a backlog of 125,044 medical applications and 24,859 SNAP applications for which eligibility was not yet determined (worked) within the 45 day or 30 day requirements, as applicable. The oldest medical applications dated back to 2013 and the oldest SNAP applications dated back to 2014. • For redeterminations - The Departments provided us information indicating that as of June 30, 2018, the Departments had incurred a backlog of 96,979* medical redeterminations and 23,199* SNAP and TANF redeterminations (see note below). The oldest medical redeterminations dated back to 2016 and the oldest SNAP and TANF redeterminations dated back to 2017. *As described in the Finding 2018-004, upon implementation of IES Phase II, the Departments extended the due dates for cases that were to be redetermined in October 2017 through December 2017. As of June 30, 2018, there were 173,331 such cases that had not yet been redetermined. These cases were not included in the 120,178 redetermination cases (96,979 medical and 23,199 SNAP) discussed in this finding. As a result, our testing indicated a total known redetermination backlog of 293,509 cases. • For change documentation received by the Departments (a/k/a maintenance) - The Departments provided us information indicating that as of June 30, 2018, there were 85,736 backlogged documents (60,992 medical and 24,744 SNAP and/or TANF documents) on hand that have been received from active recipients to update eligibility information pertaining to their cases, which were not related to either their initial application or annual redetermination. For example, a recipient who got a new job between the date of original application, but before his/her scheduled annual redetermination date, would need to supply the Departments with new income information, which would in turn likely impact their benefit levels. (Finding 9, page 133-137) We recommended the Departments (1) provide significant oversight to ensure the corrective action plans are submitted and approved within the required timeframe, (2) ensure every provision within the corrective action plans is strictly adhered to and fully implemented, (3) work together to implement controls to comply with the requirement that applications are reviewed and approved or denied within 45 or 30 days, as applicable, (4) establish appropriate controls to both monitor the progress of eligibility redeterminations and ensure those redeterminations occur timely, (5) the internal audit functions of the Departments should periodically monitor adherence to the established controls, and (6) assign and train any additional personnel necessary so that initial applications are worked and redeterminations and maintenance of eligibility are performed within the timeframes required by the Code. DHS accepted the recommendation and stated it defers to HFS for any oversight to the Corrective Action Plan with the Federal CMS mentioned in the audit report. Further, DHS stated it will (1) properly monitor the Supplemental Nutrition Assistance Program timeliness rate in order to address the formal warning process imposed by FNS, (2) continue to work with HFS to implement controls to comply with the requirement that applications are reviewed and approved or denied timely, (3) assign and train additional personnel to ensure initial applications are worked and redeterminations and maintenance of eligibility are performed within the timeframes required by the Code, and (4) continue to audit systemic IT and programmatic controls within the internal audits as prescribed by its internal audit plan. OTHER FINDINGS The remaining findings pertain to the methodology used for calculating the allowance for doubtful accounts not being accurate, a lack of adequate controls over the review of internal controls over service providers, inadequate general information technology controls over IMPACT, insufficient review and documentation of provider enrollment determinations, deletion of four months of intake eligibility files and significant problems in determining eligibility for human service programs, lack of controls over changes to the IES, and a lack of security controls over the IES. We will review the Department’s progress towards the implementation of our recommendations in our next financial audit. AUDITOR’S OPINIONS The auditors stated the financial statements of the Department of Human Services as of and for the year ended June 30, 2018 are fairly stated in all material respects. This financial audit was performed by RSM US LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:jv